{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"orange","date":"2025-07-25","year":2025,"org":"Orange","domain":"orange.com","kind":"company","sector":"Telecommunications","sectorLabel":"Telecommunications","severity":"high","status":"confirmed","affected":null,"affectedLabel":"Limited business-related files later acknowledged stolen; no customer-person count","data":"Later acknowledged: limited old or low-sensitivity business-related files. No confirmed consumer-database theft.","method":"Cyberattack on an information system; the initial access route has not been published.","risk":"Service disruption, then reconnaissance and phishing risk from leaked business files.","confidence":"Official disclosure, later qualified by a spokesperson. WarLock is press reporting, not Orange attribution.","sourceName":"Orange","sourceId":"orange","sourceUrl":"https://newsroom.orange.com/the-orange-group-announces-that-it-filed-a-complaint-on-monday-28-july-concerning-a-security-incident-on-one-of-its-information-systems/?lang=eng","sourceIds":["orange","orangeFollowup","orange01net"],"lastResearched":"2026-08-16","url":"/incident/orange","detail":{"lead":"Orange detected a cyberattack on one of its information systems on 25 July 2025. Isolating potentially affected services interrupted some business-management platforms and several consumer-facing services, mainly in France. On 28 July the company said it had found no evidence that Orange or customer data had been exfiltrated.\n\nThat first conclusion did not hold. In August, material attributed to the intrusion appeared on a criminal leak site. Orange then acknowledged limited access and that old or low-sensitivity information concerning business customers had been taken. No verified customer-person count has been published. A separate Orange Belgium event affecting about 850,000 accounts is not this incident.","timeline":[{"date":"2025-07-25","label":"Orange detects a cyberattack on one information system."},{"date":"2025-07-28","label":"Public disclosure: services isolated, complaint filed, no evidence of exfiltration at that stage."},{"date":"2025-07-30","label":"Initial recovery target for the principal disrupted services, under heightened monitoring."},{"date":"2025-08-25","label":"ZDNet and then 01net report that Orange has acknowledged limited access and theft of old or low-sensitivity business-related information."}],"how":"Orange has not published an initial-access vector. Isolation of potentially affected services caused part of the visible outage. Later security reporting characterised the event as a ransomware or extortion incident associated with WarLock on the basis of leak-site activity; that is reporting, not a formal attribution by Orange.","taken":"Later reporting, quoting an Orange spokesperson, described stolen material as old or low-sensitivity data related to business customers, obtained through only limited access. ZDNet reported that seven internal documents appeared on the leak site. There is still no public, verified number of individuals affected by this France incident.","notTaken":"Orange did not confirm theft of passwords, payment-card data, or a French consumer customer database in this incident. The Orange Belgium breach disclosed later in August is a separate event and is not counted here.","impact":"The immediate impact was operational: disruption to business-management services and some consumer services while systems were isolated. The secondary impact was trust and disclosure risk, because the public account evolved from no evidence of exfiltration to an acknowledged limited leak. Even old operational documents can aid reconnaissance, impersonation, supplier fraud and follow-on phishing.","response":"Orange Cyberdefense isolated affected or potentially affected services, Orange filed a complaint, and authorities were notified. Services were progressively restored under enhanced monitoring. After data appeared publicly, Orange said affected companies had been informed before publication and that it was cooperating with them and the competent authorities.","methodDisclosure":"undisclosed","attackerClaim":"Reporting linked a leak-site publication of about 4 GB to the WarLock extortion operation. Orange did not publish a formal attacker attribution, and the claimed volume is not a victim count.","revision":"The 28 July statement was accurate only as a statement of what the company knew then. A durable record has to preserve the later revision: Orange initially found no evidence of exfiltration, then acknowledged that a limited set of older or low-sensitivity business-related data had been stolen and published. The scope of affected people remains unknown.","quotes":[{"text":"isolate the potentially affected services and limit the impact","original":"isoler les services potentiellement concernés et limiter les impacts","originalLang":"fr","attribution":"Orange, 28 July 2025","sourceId":"orange"},{"text":"limited access","original":"un accès limité","originalLang":"fr","attribution":"Orange spokesperson, reported by 01net","sourceId":"orange01net"},{"text":"old or low-sensitivity data","original":"des données obsolètes ou de faible sensibilité","originalLang":"fr","attribution":"Orange spokesperson, reported by 01net","sourceId":"orange01net"}]}},"source":{"id":"orange","name":"Orange - Security incident disclosure","url":"https://newsroom.orange.com/the-orange-group-announces-that-it-filed-a-complaint-on-monday-28-july-concerning-a-security-incident-on-one-of-its-information-systems/?lang=eng","publisher":"Orange","kind":"primary","published":"2025-07-28"},"sources":[{"id":"orange","name":"Orange - Security incident disclosure","url":"https://newsroom.orange.com/the-orange-group-announces-that-it-filed-a-complaint-on-monday-28-july-concerning-a-security-incident-on-one-of-its-information-systems/?lang=eng","publisher":"Orange","kind":"primary","published":"2025-07-28"},{"id":"orangeFollowup","name":"ZDNet — Orange later confirmed a limited data leak","url":"https://www.zdnet.fr/actualites/la-cyberattaque-dorange-se-solde-finalement-par-une-fuite-de-donnees-480732.htm","publisher":"ZDNet France","kind":"secondary","published":"2025-08-25"},{"id":"orange01net","name":"01net — Orange data published on a leak site","url":"https://www.01net.com/actualites/cyberattaque-contre-orange-donnees-piratees-diffusees-dark-web.html","publisher":"01net","kind":"secondary","published":"2025-08-26"}]}