{
  "type": "bundle",
  "id": "bundle--c7e0b381-446b-542e-89b4-3b8cea367117",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--55ad8b19-a12a-534e-852e-e64655bbdd08",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "org:456fb740-561a-4d65-b0c0-a42cc19124b3",
      "name": "Free Mobile",
      "identity_class": "organization"
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--8770b1eb-bd15-5d9b-8b2a-0a58704c97c9",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "org:8768e597-c212-4415-a198-42ad9c5db230",
      "name": "Free",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--5bea881e-614f-5f7e-8027-163f37e749aa",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "inc:d8663c92-60ee-423b-ad06-2818754ee998",
      "name": "October 2024 Free Mobile and Free intrusion"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--ff952ebb-c3c3-5208-8e1e-06ea94066655",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "brh:142748af-8d0a-4d2a-8afe-d13a491b1844",
      "name": "Free Mobile and Free subscriber data breach"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04f3e19a-4437-5bff-8423-eda3fc3ef9d6",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:99cf901e-b59d-4be9-bf93-9891fd3c1382",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--6afac467-c8cd-5a58-865d-0f99b375e110",
      "target_ref": "x-ally-data-category--86ad8aed-d624-5e22-8711-66a3087cd0b3",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:74044dd4-f101-4362-9bd4-daafeab70600",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d6b995e-4af9-54f7-8c1c-e1b633838857",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:e6ed1308-80e5-44cc-84e8-d5f51bf372b1",
      "relationship_type": "affected-organization",
      "source_ref": "x-ally-legal-proceeding--ba76be3c-4ae3-5e20-8df0-eb59cd62e53e",
      "target_ref": "identity--8770b1eb-bd15-5d9b-8b2a-0a58704c97c9",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:8768e597-c212-4415-a198-42ad9c5db230",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2462ed4c-1322-520d-8bc4-a727c290a98b",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:0e27902d-6d45-4be6-b42a-16151680bcf8",
      "relationship_type": "affected-organization",
      "source_ref": "x-ally-legal-proceeding--77603a95-1602-5317-8f64-8e6848332bc0",
      "target_ref": "identity--55ad8b19-a12a-534e-852e-e64655bbdd08",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:80431897-a686-44af-81be-84897135a955",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40478d2f-453a-5e68-8c48-22c07fc9c5d3",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:7a10b3d2-17bc-4ad5-8b9b-a1588826f590",
      "relationship_type": "resulted-in",
      "source_ref": "incident--5bea881e-614f-5f7e-8027-163f37e749aa",
      "target_ref": "x-ally-legal-proceeding--ba76be3c-4ae3-5e20-8df0-eb59cd62e53e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:adb47a1a-bebb-4864-869e-14f42faba072",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b8d17aa-209c-5836-8e85-b0af1b9441c3",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:866311e2-82d5-4a0f-8134-05c143a70e72",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--6afac467-c8cd-5a58-865d-0f99b375e110",
      "target_ref": "x-ally-data-category--52b3cbb9-715e-51b4-8264-46d4b1a49ec4",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:7ba645d0-753d-49f8-91b3-df03feddca7c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6e99f63-41e9-575f-8c3c-5ffac86bf753",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:c8b49731-b24e-4fe3-8442-c821c2647f0e",
      "relationship_type": "affected-organization",
      "source_ref": "incident--5bea881e-614f-5f7e-8027-163f37e749aa",
      "target_ref": "identity--8770b1eb-bd15-5d9b-8b2a-0a58704c97c9",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:b120b047-69ec-467f-b45f-94d651bd0e4e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9cf7513-c69f-5112-8562-4f08d82d8498",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:4ce15aec-7ac9-4984-ada4-79fe545baa2b",
      "relationship_type": "resulted-in",
      "source_ref": "incident--5bea881e-614f-5f7e-8027-163f37e749aa",
      "target_ref": "x-ally-data-exposure--6afac467-c8cd-5a58-865d-0f99b375e110",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:13464308-aeed-43f6-8b0a-4fd1db70ea5b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e17aa043-4085-5ceb-8afe-c6fe57a3bef8",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:f8fa7faa-ad8b-465e-b9eb-5cc355b50c08",
      "relationship_type": "resulted-in",
      "source_ref": "incident--5bea881e-614f-5f7e-8027-163f37e749aa",
      "target_ref": "x-ally-legal-proceeding--77603a95-1602-5317-8f64-8e6848332bc0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:f04d4765-977e-4218-99d3-5bc070e79330",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eccf2d7e-0059-5b24-8837-ed21e32914bd",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:56a597ab-63a2-4af5-8d27-35854ae3ed23",
      "relationship_type": "affected-organization",
      "source_ref": "incident--5bea881e-614f-5f7e-8027-163f37e749aa",
      "target_ref": "identity--55ad8b19-a12a-534e-852e-e64655bbdd08",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:fc85a5c1-30a3-49af-bc74-da20e4b730fa",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--02658dec-2cdb-5e49-8da3-69fa0e40a029",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:68b2bc91-3a0b-4d89-bf8a-3baf682060d2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:142748af-8d0a-4d2a-8afe-d13a491b1844",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The CNIL found the companies' initial email notice omitted information people needed to understand consequences and protective steps."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4aee228f-a094-573c-8c09-75f835675127",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:8f63f367-066f-48fe-92cd-71f60623b629",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:456fb740-561a-4d65-b0c0-a42cc19124b3",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The CNIL imposed a €27 million administrative fine on Free Mobile."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--706501e8-9690-5ab1-8540-5ccc9d5c344c",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:41a4f794-acfb-496a-8a09-0862258d302a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:d8663c92-60ee-423b-ad06-2818754ee998",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The CNIL ordered Free Mobile to complete sorting and purging unjustifiably retained former-subscriber data within six months of notification."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--908164d4-fc07-5622-8dab-f4db33e7a7d7",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:1638845b-bfab-425e-a515-434a35083a91",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:dc45a40e-a26d-4722-929d-c3128fd0da54",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "integer",
        "value": 24000000,
        "unit": "record",
        "approximate": true
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--aa53b6b7-220b-54cb-8547-cabbdbfd5f71",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:aee2c335-13ce-4901-b2e4-e23fc1a219b1",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:f0e395bd-cfa4-401b-9b89-dcabee62f7a4",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-01-13"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c76f4911-ea86-5e46-8bd8-8f97eeea63cc",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:956caecd-9bec-41af-91df-0675c6746f54",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:0950d663-834c-4c32-bab6-73594846c859",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-01-13"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--cd38adb7-5675-567d-8e86-e6a235f8b945",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:68141942-19f3-4d57-a042-5508122b72cb",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:ed1c7c79-d9fe-4821-a761-200c2b8f53b8",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The CNIL says an attacker infiltrated the companies' information systems and accessed subscriber personal data in October 2024; the summary does not provide a day-level incident date."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--fcd98175-38e2-5826-8bb0-b03ed0391f7f",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:557bd9de-9aae-4eed-995a-1df99ba77522",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:2c140377-f17e-4308-b0b8-43faa8abe8f0",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The CNIL found that authentication for the companies' employee VPNs was insufficiently robust and their abnormal-behavior detection measures were ineffective."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--fe50d671-4d24-50c0-8954-b95b7e2f3f2b",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "clm:ebc3f8b8-6343-47e9-8493-586da12218af",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Commission nationale de l'informatique et des libertés",
          "url": "https://cnil.fr/fr/sanction-free-2026",
          "external_id": "cit:1267b94e-6c89-4512-80ea-a8e02b6cf8eb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9fe49269ada4a0daaef1dd01d8027c4cc4b09e0a64af6819f61cb8e49bfafa91"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The CNIL imposed a €15 million administrative fine on Free."
      }
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--52b3cbb9-715e-51b4-8264-46d4b1a49ec4",
      "created": "2026-08-08T23:23:24Z",
      "modified": "2026-08-08T23:23:24Z",
      "x_ally_original_id": "dat:c73589f6-cdb1-4fc7-9675-e1ef42363ada",
      "name": "Financial account information"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--86ad8aed-d624-5e22-8711-66a3087cd0b3",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "dat:f0e395bd-cfa4-401b-9b89-dcabee62f7a4",
      "name": "Subscriber contract information"
    },
    {
      "type": "x-ally-data-exposure",
      "spec_version": "2.1",
      "id": "x-ally-data-exposure--6afac467-c8cd-5a58-865d-0f99b375e110",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "exp:1f105785-d954-4d38-9495-225ce811d7ff",
      "name": "Free subscriber-contract data exposure"
    },
    {
      "type": "x-ally-legal-proceeding",
      "spec_version": "2.1",
      "id": "x-ally-legal-proceeding--77603a95-1602-5317-8f64-8e6848332bc0",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "lgl:f34dac77-706f-4e6a-af12-0361f3bdafc7",
      "name": "CNIL proceeding SAN-2026-001 against Free Mobile"
    },
    {
      "type": "x-ally-legal-proceeding",
      "spec_version": "2.1",
      "id": "x-ally-legal-proceeding--ba76be3c-4ae3-5e20-8df0-eb59cd62e53e",
      "created": "2026-08-09T01:50:48Z",
      "modified": "2026-08-09T01:50:48Z",
      "x_ally_original_id": "lgl:f6cd6afb-a3e8-48ac-b32c-304fb73d5f58",
      "name": "CNIL proceeding SAN-2026-002 against Free"
    }
  ]
}