One Attack — and All of France’s Communications Collapsed. Who’s Targeting Orange?
Experts recognize the attackers’ signature — but are afraid to say it outright.
Experts recognize the attackers’ signature — but are afraid to say it outright.
The French telecommunications giant Orange, which serves nearly 300 million customers worldwide, has reported a serious security incident that disrupted key services across France. The breach was discovered on the evening of July 25 by Orange Cyberdefense, after which the affected system was immediately isolated from the rest of the infrastructure.
Despite the rapid response, containing the threat led to temporary outages in corporate platforms and some consumer services, including access to service management and internal administrative functions. The disruptions mainly affected customers within France, and full recovery is expected later today.
After detecting the attack, Orange notified relevant authorities and filed an official complaint, though details about the attack vectors used by the threat actors remain undisclosed. The company emphasized that, at this stage of the investigation, there is no evidence of data leakage or theft of confidential information.
However, the incident bears striking similarities to a wave of attacks previously attributed to the Chinese hacking group Salt Typhoon — known from CISA and FBI reports about operations targeting telecom operators in the U.S. and beyond. Previous victims of these large-scale intrusions included AT&T, T-Mobile, Verizon, Lumen, Windstream, and satellite providers like Viasat.
Interestingly, this is the second time in six months that Orange has been attacked. In February 2025, a hacker using the alias Rey claimed responsibility for breaching the infrastructure of Orange’s Romanian division. That incident involved access to internal documents, codes, contracts, email addresses, and employee data — with sources alleging that over 380,000 email addresses were stolen. Orange later acknowledged a breach in an auxiliary application but insisted that critical infrastructure remained unaffected.
Orange holds a dominant market position across Europe, Africa, and the Middle East, offering mobile communications, broadband internet, and business cloud services. As of 2024, the company served 256 million mobile and 22 million fixed-line clients, employed over 125,000 people, and generated €40.3 billion in annual revenue.
Despite no confirmed data breaches in the current incident, the level of concern remains high: the risk of renewed espionage campaigns is very real — especially given the sensitivity of telecom infrastructure and Orange’s global reach.
