25 July 2025
Orange
Company Telecommunications
Orange detected a cyberattack on one of its information systems on 25 July 2025. Isolating potentially affected services interrupted some business-management platforms and several consumer-facing services, mainly in France. On 28 July the company said it had found no evidence that Orange or customer data had been exfiltrated.
That first conclusion did not hold. In August, material attributed to the intrusion appeared on a criminal leak site. Orange then acknowledged limited access and that old or low-sensitivity information concerning business customers had been taken. No verified customer-person count has been published. A separate Orange Belgium event affecting about 850,000 accounts is not this incident.
Dated facts in the public record
Orange detects a cyberattack on one information system.
Public disclosure: services isolated, complaint filed, no evidence of exfiltration at that stage.
Initial recovery target for the principal disrupted services, under heightened monitoring.
ZDNet and then 01net report that Orange has acknowledged limited access and theft of old or low-sensitivity business-related information.
How it happened
Orange has not published an initial-access vector. Isolation of potentially affected services caused part of the visible outage. Later security reporting characterised the event as a ransomware or extortion incident associated with WarLock on the basis of leak-site activity; that is reporting, not a formal attribution by Orange.
What was exposed
Later reporting, quoting an Orange spokesperson, described stolen material as old or low-sensitivity data related to business customers, obtained through only limited access. ZDNet reported that seven internal documents appeared on the leak site. There is still no public, verified number of individuals affected by this France incident.
What was not in scope
Orange did not confirm theft of passwords, payment-card data, or a French consumer customer database in this incident. The Orange Belgium breach disclosed later in August is a separate event and is not counted here.
What it meant in practice
The immediate impact was operational: disruption to business-management services and some consumer services while systems were isolated. The secondary impact was trust and disclosure risk, because the public account evolved from no evidence of exfiltration to an acknowledged limited leak. Even old operational documents can aid reconnaissance, impersonation, supplier fraud and follow-on phishing.
Attacker claim (not a confirmed count)
Reporting linked a leak-site publication of about 4 GB to the WarLock extortion operation. Orange did not publish a formal attacker attribution, and the claimed volume is not a victim count.
What was done next
Orange Cyberdefense isolated affected or potentially affected services, Orange filed a complaint, and authorities were notified. Services were progressively restored under enhanced monitoring. After data appeared publicly, Orange said affected companies had been informed before publication and that it was cooperating with them and the competent authorities.
What later reporting changed
The 28 July statement was accurate only as a statement of what the company knew then. A durable record has to preserve the later revision: Orange initially found no evidence of exfiltration, then acknowledged that a limited set of older or low-sensitivity business-related data had been stolen and published. The scope of affected people remains unknown.
In their words
isolate the potentially affected services and limit the impact
Original isoler les services potentiellement concernés et limiter les impacts
Orange, 28 July 2025
limited access
Original un accès limité
Orange spokesperson, reported by 01net
old or low-sensitivity data
Original des données obsolètes ou de faible sensibilité
Orange spokesperson, reported by 01net
What does this mean?
- Phishing
- A message or call that imitates a real organisation to get you to hand over a password, a code or a payment.
- Exfiltration
- Copying data out of a system to somewhere the attacker controls.
- Supplier or supply-chain exposure
- Data leaks through a company that works for the organisation, rather than from the organisation itself.
- Edge or legacy system
- Equipment sitting at the boundary of a network, or older software still in service — both are common first footholds.