Orange România

Summary

Orange România was targeted by a hacker known as Rey, who claimed affiliation with the HellCat ransomware group. The attacker said he gained entry through compromised credentials and vulnerabilities in the company’s Jira issue‑tracking system, maintaining access for over a month before extracting data during a three‑hour window. He reported stealing approximately 380 000 unique email addresses, internal documents, source code, invoices, contracts and partial payment‑card details, some of which had already expired, and noted that customer data from the Yoxo subscription service was also included. A ransom note was left on the compromised systems, but the company did not respond, and the stolen information was later posted on a hacker forum.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

A hacker known as “Rey,” who is associated with the HellCat ransomware group, claimed responsibility for infiltrating the systems of the French telecommunications company Orange, specifically affecting its Romanian operations. According to his statements, Rey gained entry by using a combination of compromised credentials and exploiting vulnerabilities in Orange’s Jira issue‑tracking software. He maintained undetected access to the network for more than one month before extracting data during a three‑hour window. Rey asserted that he attempted to extort the company but received no response, after which the stolen information was posted on a hacker forum. He emphasized that the intrusion was not conducted as part of a HellCat ransomware campaign, despite his affiliation with the group.

The data exfiltrated primarily concerned Orange Romania and comprised approximately 380,000 unique email addresses, internal company documents, and client information. Samples of the leaked data included email addresses belonging to current and former employees, partners, and contractors, as well as source code, invoices, contracts, and partial payment‑card details linked to Romanian clients. Some of the email addresses corresponded to individuals who had not been Orange customers for over five years, and many of the exposed card details had already expired. Rey also confirmed that client data from Yoxo, Orange’s no‑contract subscription service, was part of the breach.

Following the intrusion, Rey left a ransom note on the compromised internal portals, but Orange did not initiate any negotiation with the attacker. The article does not describe any additional containment, remediation, or public communication efforts undertaken by the company after the leak. The stolen data remains accessible on the hacker forum, and no further details about detection timelines or official statements from Orange are provided in the source material.

Sources

Sources available to members: 1 source.