Free: 100,000 French IBANs are accessible for free on the darknet

Published on October 28, 2024

The news broke at the end of last week, and it is now official. On Friday, October 25, Free confirmed that it had been the victim of a cyberattack, resulting in the theft of some of its subscribers' data. At the time, the operator did not elaborate on the nature and volume of this personal data. For his part, the alleged hacker was much more talkative, reporting more than 5 million IBANs - the vast majority of which were French - belonging to the company's subscribers. In total, 5.11 million banking data were allegedly stolen, making the incident one of the largest cyberattacks ever recorded against a French telephone operator.

100,000 IBANs as proof

This weekend around 4:30 in the morning, our colleagues at Univers Freebox report, the alleged hacker wanted to strike hard, by distributing a sample of 100,000 IBANs for free on a dark web sales site. If the exposed data is confirmed by the company, it will only be a matter of time before the 5 million additional bank identifiers are sold to the highest bidders.

In addition to providing himself with a prime advertisement for malicious Internet users who would like to illegally acquire the banking data of Free customers, the hacker is also said to have launched this counter-offensive to put Xavier Niel's operator in default. Earlier this week, and despite our requests, Free had indeed assured that no passwords or bank cards had been stolen, but had been careful not to mention the IBANs. As a media punishment, the hacker decided to play the party pooper, by delivering 100,000 IBANs as fodder to cybercriminals, while ironically taking up the title of Xavier Niel's recently published book: "A sacred desire to frighten the mess".

Free does not negotiate

After putting the data collected at Free up for sale for €10,000, the auction finally went up to €65,000. “I have given Free SAS the opportunity to buy its own database in a single sale so far to avoid very dramatic and worrying consequences for all its customers, but without any response from them for the moment.”

Unfortunately, this type of situation seems destined to repeat itself. Following the cyberattack that hit SFR in September, it is strongly recommended to implement all possible security measures to avoid possible repercussions. Many features now allow you to protect yourself without too much effort. Password managers are now integrated into most smartphones and browsers and are an essential tool to avoid account hacking. Also remember to activate two-factor authentication when sites and applications offer it.

Source: Journal du geek