850,000 Orange Belgium Customers Exposed in Warlock Ransomware Breach

On August 20, 2025, Orange Belgium disclosed a significant cyberattack impacting 850,000 customers, approximately one-third of its subscriber base in Belgium and Luxembourg. The breach, detected in late July, exposed sensitive personal data including :

Full names and telephone numbers
SIM card serial numbers
Tariff plan details
PUK (Personal Unblocking Key) codes—critical for SIM card recovery

Notably, the company confirmed that passwords, email addresses, and financial data were not compromised, as these are stored on separate, isolated systems. The breach primarily affected a customer management database, though operational services remained uninterrupted.

Attack Methodology and Threat Actor Analysis

Exploited Vulnerabilities

The intrusion has been attributed to Warlock, an emerging ransomware gang exploiting a chain of SharePoint Server vulnerabilities known as ToolShell. These vulnerabilities, patched by Microsoft in July 2025, allow authentication bypass and remote code execution (RCE). Trend Micro researchers noted that Warlock used HTTP POST requests to upload webshells, followed by lateral movement using Group Policy abuse and credential theft.

Data Exfiltration & Extortion

Warlock claims to have exfiltrated data without encrypting systems—a trend increasingly common among ransomware groups focusing on extortion. Orange Belgium refused to pay a ransom, leading to the data being published on dark web leak sites. The group’s tactics mirror those of LockBit 3.0, whose source code was leaked in 2023.

Orange’s Response and Criticisms

Orange Belgium’s incident response included:

Immediate isolation of affected systems and security hardening
Notification to regulatory authorities (Belgian Data Protection Authority) and judicial bodies
Customer alerts via SMS and email with recommendations for vigilance

However, cybersecurity experts criticized the response:

Inti De Ceukelaire (Chief Hacker at Intigriti) accused Orange of downplaying risks like SIM swapping and number theft, relying on a "corporate PR playbook" rather than proactive measures.
Customers expressed frustration over the lack of tangible support (e.g., SIM card replacements) and emphasis on users self-managing risks.

Historical Context: Orange’s Cybersecurity Challenges

This incident is the third major cyberattack against Orange subsidiaries in 2025:

Date	Target	Threat Actor	Impact	Source
February 2025	Orange Romania	HellCat/Rey	6.5GB of employee data, partial payment cards, and 380,000 email addresses
July 2025	Orange Group (France)	Unidentified	Operational disruptions; no data confirmed stolen

These incidents highlight systemic vulnerabilities in Orange’s infrastructure, including:

Third-party access points (e.g., partner portals in the Romania breach)
Delayed patching of critical software (e.g., SharePoint vulnerabilities)
Inconsistent security protocols across subsidiaries

Broader Telecom Sector Threats

The Orange Belgium breach occurred amid a global surge in telecom-targeted attacks:

Telefónica Peru: Breached by "Dedale" group, impacting 1 million customers.
U.S. Carriers (Verizon, AT&T): Infiltrated by China-linked Salt Typhoon seeking wiretap information.
Colt Technology Services: Targeted by Warlock in parallel attacks, disrupting customer portals and APIs.

Regulatory bodies like the FCC are tightening cybersecurity requirements for critical communications infrastructure, emphasizing Zero Trust frameworks and mandatory incident reporting.

850,000 Orange Belgium Customers Exposed in Warlock Ransomware Breach

Related threat feeds

AssuranceAmerica Breach Leaks 6.99M Driver's Licenses