Skip to content
vindicis

Free data breach — are you affected?

In October 2024 the French internet and mobile provider Free suffered a breach, put on sale and later leaked publicly. About 14 million unique email addresses were exposed along with names, postal addresses, phone numbers, genders, birth dates and, in many records, IBAN bank account numbers. Free said the IBAN alone is not enough to make a direct debit.

Key facts
Verified
Breach date
17 October 2024
Accounts affected
13,926,173
Added to catalogue
27 May 2025
Website
free.fr

Data exposed

  • Bank account numbers, high risk
  • Dates of birth, medium risk
  • Phone numbers, medium risk
  • Physical addresses, medium risk
  • Genders, lower risk
  • Names, lower risk

Colour shows how damaging the data is if misused.Credentials, ID and bank dataContact and personal detailsOther profile data

What this means for you

Based on the types of data in this breach, in order of importance.

  • Stay alert to identity fraud

    Birth dates and identity document numbers cannot be changed like a password. Be wary of anyone who quotes them to sound legitimate, check bank statements and credit reports regularly, and use a credit-file freeze or fraud alert where your country offers one.

  • Check bank and card activity

    Bank or payment details were among the data. Look for debits you do not recognise, ask your bank whether to replace a card or account, and ignore calls or texts that claim to be your bank and ask for codes.

  • Watch for smishing and SIM-swap attempts

    A leaked phone number lets criminals send convincing text messages and try to take over the number. Do not tap links in unexpected SMS, set a PIN with your mobile carrier and prefer an authenticator app to SMS codes.

  • Expect phishing letters and delivery scams

    A physical address makes impersonation more believable and enables fake letters and parcel notices. Treat unexpected post or delivery messages asking for money or details with suspicion, and check anything official on the sender’s own website.

  • Limit what attackers can personalise

    Names, employers, job titles and social profiles make impersonation and spear-phishing easier. Check what your public profiles reveal, and be careful with unexpected requests that use your real name or workplace.

Check your own email address

Run a free self-assessment for an email address you own. VINDICIS checks it against infostealer logs and several public breach sources and shows a summary in seconds.

Built for your own addresses. It is not a tool to look up other people.

Run a free self-assessmentCheck a password

Related breaches

Breaches that exposed similar kinds of data.

Frequently asked questions

Was my data in the Free breach?

Only a check of your own address can tell. If you had an account with Free around 2024, assume it might be. Run the free self-assessment with an email address you own: VINDICIS checks it against several public breach sources and shows a summary in seconds. It is built for your own addresses, not for looking up other people.

What information was exposed in the Free breach?

According to the Have I Been Pwned catalogue, the Free breach affected 13,926,173 accounts and exposed: Bank account numbers, Dates of birth, Phone numbers, Physical addresses, Genders, Names. The incident dates from 17 October 2024.

What should I do if I had a Free account?

Review the security settings of your Free account and treat unexpected emails, texts or letters that mention Free with suspicion. Delete the account if you no longer use it.

Is it safe to check my email address on VINDICIS?

Yes. The free scan is not stored or logged, results stay in memory for four hours at most, and your browser only talks to this site. The password checker hashes locally and sends only five characters of the hash, so the password never leaves your device.