Canadian carrier Freedom Mobile has disclosed a breach of its customer account management platform that exposed personally identifiable information and account details for an undisclosed number of subscribers. The incident highlights the security implications of third-party access to systems that underpin SIM management and mobile account control, which are increasingly central to digital identity and multi-factor authentication.
In a notice dated December 3, 2025, Freedom said it detected unauthorized activity on its customer account management platform on October 23. The company’s investigation concluded that a third party used the account of a subcontractor to access personal information associated with a limited number of customers. Freedom reports that it blocked suspicious accounts and IP addresses and has implemented additional monitoring and security enhancements.
The data exposed includes customer first and last names, home addresses, dates of birth, phone numbers, and Freedom Mobile account numbers. Payment information and passwords are not believed to have been affected. Even so, the combination of name, date of birth, contact details, and account identifiers can be used to support downstream identity fraud, targeted phishing, and social-engineering attacks that seek to take over mobile subscriptions, port numbers, or request new SIMs and eSIM activations.
Freedom is Canada’s fourth-largest wireless carrier, with more than 2.2 million subscribers and national coverage, and is owned by Quebecor subsidiary Vidéotron. A company spokesperson told BleepingComputer that the attack did not affect Freedom’s network or operations and described the incident as distinct from ransomware, but declined to say how many subscribers were impacted. The same outlet notes that Freedom previously confirmed a 2019 incident in which a third-party vendor left an unsecured customer support database exposed, affecting roughly 15,000 customers.
The breach underscores how subcontractor and vendor accounts can become a weak link in the control plane that governs mobile identities. For organizations that rely on carrier phone numbers as a factor in authentication or account recovery, compromise of customer management platforms can increase the risk of SIM swap fraud or unauthorized changes being made on the back end. CISOs and risk teams may want to revisit how strongly they trust SMS-based factors for high-value transactions, and how they vet and monitor third parties with privileged access to identity-relevant systems.
Freedom has advised affected customers to treat unsolicited messages asking for personal information with caution, avoid clicking unexpected links, and monitor their accounts for unusual activity. It is also directing customers to the Canadian Anti-Fraud Centre for additional guidance.
Sources: Freedom Mobile, BleepingComputer
—
By the ID Tech Editorial Team
