Hacker Claims Breach at French ISP ‘Free’ Impacting 19.2 Million Customers

A threat actor going by the alias “drussellx” has claimed on BreachForums to sell the personal data of 19.2 million customers of the French internet service provider (ISP) Free.

The hacker details a massive data breach that allegedly includes sensitive customer information, such as identity details, emails, and bank account numbers of over 5.11 million Freebox subscribers. The stolen dataset, which spans both Free Mobile and Freebox customers, amounts to 43.6 GB of text files containing a wide range of customer records.

According to the forum post, the breached data contains the following customer details:

• Free Mobile: User IDs, logins, names, emails, postal addresses, dates of birth, service offer details, account statuses, and mobile numbers.
• Freebox Subscribers: In addition to the above data, records include IBAN numbers, Freebox IDs, service activation dates, and bank-related identifiers like BIC codes.

The breach reportedly affects both residential and mobile customers, with Free Mobile users' service and subscription data, while Freebox subscribers' records include financial details like IBANs, signaling a deeper breach for Freebox customers.

The hacker claims the breach occurred recently, on October 17, 2024. The post offers a downloadable sample of the data to prove its authenticity, displaying customer data in structured text format. Among the exposed data is personally identifiable information (PII), including names, emails, street addresses, and account details, alongside financial data such as bank account numbers and IBANs. Additionally, screenshots were posted as further proof.

Several Free customer records included in the sample suggest that the leak might be authentic instead of AI-generated. Each record includes typical customer metadata: postal codes, email addresses, mobile offers, activation statuses, and associated bank details where relevant.

Potential impact

Free SAS, commonly known as Free, is a major ISP and mobile operator in France, serving millions of customers through its Free Mobile services and Freebox broadband offerings. The company's customer base is extensive, with Freebox being a popular choice for home internet services and Free Mobile offering affordable mobile plans. A breach of this scale, if verified, could have significant consequences for the privacy and security of a vast portion of its customer base.

Free SAS has not yet confirmed the legitimacy of the breach. We reached out to the company for comment, but no response has been received at the time of publication. As such, the data breach has not been confirmed yet.

Out of an abundance of caution, and until Free comes public with a statement on the threat actor's allegations, potentially affected Free customers should:

• Monitor their bank accounts for any suspicious activity.
• Update passwords and enable two-factor authentication for Free Mobile and Freebox accounts.
• Be cautious of phishing emails or text messages that may exploit the leaked data.