Free Data Breach (2024)

On October 17, 2024, French ISP Free was listed in a major data breach database after a 2024 incident that exposed records belonging to 13.9 million customers. The breach, which later appeared for sale and was eventually leaked publicly, includes highly sensitive personal and financial details that can be used for identity theft, account takeovers, and targeted fraud against you and your family.

Reported Details from the Disclosure

The primary disclosure confirms that the compromised dataset contains 14 million unique email addresses, along with names, physical addresses, phone numbers, genders, dates of birth, and, for many records, IBAN bank account numbers. Free stated that the bank details “were not enough to make a direct debit from a bank,” yet the volume and combination of data still creates serious risk. The company has not publicly quantified exactly how many records included full financial details, and the leak-site listing does not detail the precise attack vector used to obtain the information.

The breach occurred sometime in 2024 and was first surfaced through Have I Been Pwned, which tracks such incidents based on verified datasets. This marks another significant exposure for a major European telecommunications provider handling millions of residential customer records.

Why This Matters for You and Your Family

When your name, address, phone number, date of birth, gender, email address, and potentially your IBAN are all bundled together, criminals gain the raw material needed to impersonate you convincingly. Fraudsters can use this information to open accounts in your name, apply for credit, or convince customer-service representatives at other companies that they are speaking with the legitimate account holder.

Physical addresses and phone numbers make spear-phishing and vishing attacks far more effective. Dates of birth combined with names and addresses are frequently used to reset passwords on banking, government, and retail sites. Even if the IBANs cannot be used for direct debits, they still allow attackers to map your financial footprint and craft convincing social-engineering scenarios. Families are especially exposed because one compromised parent record often links to children through shared addresses and phone numbers.

Doxxing and Identity-Chain Implications

The real danger extends beyond immediate fraud. This type of dataset fuels long-term doxxing chains. Attackers cross-reference the leaked information with gaming accounts, social-media handles, and data from previous breaches to build complete identity profiles. A single exposed email or phone number can unlock additional accounts that were never part of the original Free breach.

Children’s gaming accounts are particularly vulnerable because they often reuse the same family email addresses or phone numbers. Once those credentials appear in underground markets, the chain can lead to harassment, account theft, or further exposure of household information. The combination of personal details and banking identifiers creates a roadmap that professional identity thieves exploit for months or years after the initial leak.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate every password you used at Free or any French telecom service and replace it with a unique passphrase; enable 2FA through an authenticator app everywhere possible.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address and contact details.
• Let remediation specialists manage takedown requests for any data-broker listings that surface from this breach.

The Free breach is a reminder that even established providers continue to lose control of the personal and financial data entrusted to them. One incident can cascade into years of increased fraud risk and privacy erosion. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks that follow leaks like this one.