FRENCH DATA REGULATOR FINES TELCO SUBSIDIARIES $48 MILLION OVER DATA BREACH

Summary from the TLDR InfoSec newsletter

France's CNIL fined Free SAS and Free Mobile, subsidiaries of Groupe Iliad, a combined €42 million after a 2024 breach exposed bank and other personal data of 24 million subscribers. Regulators cited weak VPN authentication, poor anomaly detection, and inadequate breach notifications, and criticized the firms' basic security lapses. The companies, which have since upgraded controls, plan to appeal, calling the sanctions unprecedented and disproportionate.