Leak at Orange

On 25 July 2025, Orange — the French multinational telecommunications group — detected unauthorized access to one of its information systems. Security teams isolated the affected systems within hours, and the group filed a criminal complaint on 28 July for an attack on one of its information systems.

The containment measures disrupted a limited number of business-facing management services and a small subset of consumer platforms, mainly in France. Orange, supported by its Orange Cyberdefense division, said it gradually restored the main affected services by the morning of 30 July. At disclosure, the operator stated that no evidence suggested customer or Orange data had been exfiltrated.

The picture later changed: in mid-August the Warlock ransomware group claimed responsibility and published roughly 4 GB of data on the dark web. Orange said the threat actor had only limited access to its systems and was able to exfiltrate only outdated or low-sensitivity data.

Reported exposure:

• Internal business-related files attributed to Orange (~4 GB published by Warlock)
• Characterized by Orange as outdated or low-sensitivity data

This incident is distinct from the separate July 2025 breach at Orange Belgium (which affected roughly 850,000 customer accounts) and from a separate leak of employee data in Romania; Orange confirmed the incidents are unrelated.