A previously-unknown threat actor has claimed that they infiltrated the internal network of French telecommunications operator Orange Group and stole thousands of confidential documents.
Recently, BleepingComputer reported that the threat actor, using the moniker “Rey,” claimed that they hacked into Orange’s internal network and stole data from its Romanian division’s systems. According to the threat actor, the stolen data includes 380,000 unique email addresses, source code, invoices, contracts, customer and employee information.
Rey, who is also a member of HellCat ransomware group, said they breached the company’s network months ago and started exfiltrating the data over the weekend, without the company detecting it.
The hacker, who took almost three hours to exfiltrate the data, confirmed that the breach didn’t involve the HellCat ransomware group.
Samples seen by BleepingComputer include email addresses from former and current Orange Romania employees, partners, and contractors, along with partial details for payment cards belonging to Romanian customers. The stolen database also contains email addresses and names of customers of Yoxo, Orange’s subscription service with no contract period.
The threat actor added that they stole almost 12,000 files totalling approximately 6.5GB after compromising Orange’s systems by exploiting compromised credentials and vulnerabilities in the company’s Jira software and internal portals.
Acknowledging the claims of the threat actor, an Orange spokesperson said that the company’s Romania division indeed suffered a data security incident, but the breach occurred from a non-critical application.
“Orange can confirm that our operations in Romania have been the target of a cyberattack. We took immediate action, and our top priority remains protecting the data and interests of our employees, customers and partners. There has been no impact on customers’ operations, and the breach was found to occur on a non-critical back office application,” an Orange spokesperson said.
The spokesperson added that the company’s “cybersecurity and IT teams are working hard to assess the extent of the breach and minimise the impact of this incident.”
“We are committed to providing regular updates. Additionally, we are committed to complying with all legal obligations associated with such incidents and we are cooperating with the relevant authorities to address this matter,” they added.
