Free, a major internet service provider (ISP) in France, confirmed over the weekend that hackers breached its systems and stole customer personal information.
The company, which says it had over 22.9 million mobile and fixed subscribers at the end of June, is the second-largest telecommunications company in France and a subsidiary of the Iliad Group, Europe's sixth-largest mobile operator by number of subscribers.
Free has since filed a criminal complaint with the public prosecutor and notified the French National Commission for Information Technology and Civil Liberties (CNIL) and the National Agency for the Security of Information Systems (ANSSI) of the incident.
"The affected subscribers have been or will be informed by email shortly," a Free spokesperson told BleepingComputer, adding that "no operational impact was observed on our activities and services" and "all necessary measures were taken immediately to put an end to this attack and strengthen the protection of our information systems."
Free added that the attack targeted a management tool that exposed subscribers' data. However, the attackers failed to access customer passwords, bank card information, and communications content (including "emails, SMS, voice messages, etc.").
The data stolen in the attack is now being auctioned on BreachForums to the highest bidder, with the threat actor—known as "drussellx"—claiming that the breach impacts almost a third of France's population.
"The data breach affects 19.2 million customers and contains over 5.11 million IBAN numbers. It affects all Free Mobile and Freebox customers, and includes the IBANs of all 5.11 million Freebox subscribers," the threat actor says.
