Free
Disclosed Oct 26, 20241 year ago13,926,173 accountsUnverified
Attack on Free management tool exposes subscriber data including IBANs
French ISP Free confirmed to AFP that a cyberattack on a management tool gave unauthorized access to personal data of some subscribers after a threat actor offered the data for sale; it said no passwords, bank cards or communications were affected. Have I Been Pwned later loaded about 14 million unique email addresses, many with IBAN bank account numbers.
What is known
| People affected | 13,926,173 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | Oct 26, 2024 |
| Happened | Oct 17, 2024 |
| Attack | Hacking |
| Data exposed | Financial, Dates of birth, Names, Phone numbers, Addresses, Emails |
| Sector | Telecom · FR |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Have I Been Pwned: Freehaveibeenpwned.com · Aggregator | Aggregator |
| France's second-largest telecoms provider Free suffered a cyber attacksecurityaffairs.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Oct 26, 2024 | |
| Have I Been Pwnedaccounts in the data | May 27, 2025 | 13,926,173 |
History of this record
- 2026-09-25 · source_type: aggregator to press · seed source
- 2026-09-25 · source_url: https://haveibeenpwned.com/Breach/FreeMobile to https://securityaffairs.com/170333/data-breach/free-suffered-a-cyber-attack.html · seed source
- 2026-09-25 · country: empty to FR · seed source
- 2026-09-25 · sector: tech to telecom · seed source
- 2026-09-25 · attack: unknown to hacking · seed source
- 2026-09-25 · data_types: ["financial","dob","names","phone","addresses"] to ["financial","dob","names","phone","addresses","emails"] · seed source
- 2026-09-25 · disclosed: 2025-05-27 to 2024-10-26 · seed source
- 2026-09-25 · summary: In October 2024, French ISP "Free" suffered a data breach which was subsequently posted for sale and later, leaked publicly. The data included 14M unique email addresses along with names, physical addresses, phone numbers, genders, dates of to French ISP Free confirmed to AFP that a cyberattack on a management tool gave unauthorized access to personal data of some subscribers after a threat actor offered the data for sale; it said no passwords, bank cards or communications were a · seed source
- 2026-09-25 · title: empty to Attack on Free management tool exposes subscriber data including IBANs · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.