Ransomware Hack Hits Orange Telecom, Data Published on Dark Web

A criminal hacking gang has stolen business customer data from French telecommunications company Orange SA and posted it online, according to people familiar with the matter.

The breach, which Orange disclosed and reported to national authorities at the end of July, targeted the company’s internal systems with ransomware associated with a gang calling itself Warlock, said the people, who spoke on the condition of anonymity to discuss sensitive information. The group released about 4 gigabytes of data onto the dark web in mid-August.

An Orange spokesperson confirmed that the hacked data was published in August. The spokesperson declined to comment about the ransomware group, known as Warlock, or any other companies potentially impacted in the incident.

“The threat actor had only limited access to our systems and was able to exfiltrate only outdated or low-sensitivity data,” the spokesperson said. “The affected companies were informed by Orange in advance of publication, and we have been working in full collaboration with them, as well as with the relevant authorities, since the beginning of this incident.”

Warlock leases out its ransomware to gangs of hackers, who use it to lock down their victims’ computers using encryption. They then demand payment to unlock affected systems.

The security incident is only the latest to hit the French telecommunications operator this year. Attackers accessed customer data from the company’s Belgian division in July in a separate compromise, while another incident led to employee data in Romania being published on the dark web.

Telecommunications companies are attractive targets for hackers as they store valuable financial information on customers as well as critical data and communication from governments and businesses.

Photograph: The Orange SA headquarters in Paris. Photo credit: Nathan Laine/Bloomberg