French telecommunications provider Free, a subsidiary of the Iliad Group and France’s second-largest internet service provider, confirmed a major data breach following unauthorized access to an internal subscriber management system. Operating under the handle “drussellx,” an adversary infiltrated administrative tooling to exfiltrate two primary databases: an archive containing personal identification details for 19.2 million subscribers, and a separate table exposing 5.11 million International Bank Account Numbers (IBANs) and associated Bic codes tied to Freebox fixed-line customers.

The threat actor auctioned the database on BreachForums and leaked a 100,000-record validation sample to dispute company statements downplaying fraud risks. Free confirmed that passwords, credit card numbers, and core telecommunication payloads (SMS, calls, emails) remained uncompromised. Initial incident assessments revealed the intrusion originated via compromised internal administrative pathways lacking granular telemetry and strict perimeter multi-factor authentication. Free notified cybersecurity authority ANSSI and data protection agency CNIL while initiating forensic audits and rotating internal management credentials.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Unsegmented internal administrative consoles and weak remote-access boundary controls allow external actors to convert isolated account compromises into high-velocity, bulk database exfiltration across central operational backends.
• Bullet 2 — Strategic & Defender Imperative: Organizations managing critical subscriber data must enforce phishing-resistant MFA across all administrative portals, mandate strict API egress throttling on bulk queries, and deploy continuous anomaly detection for internal data access.