Orange Belgium cyberattack: 850,000 customers hit by the Warlock group

A major Orange Belgium cyberattack was revealed on 20 August 2025, affecting 850,000 customer accounts of the Belgian telecom operator. The incident, which took place at the end of July, illustrates the rise of the Warlock ransomware group, which is stepping up attacks against critical European infrastructure. This cyberattack raises important questions about data security in the telecommunications sector.

Details of the Orange Belgium cyberattack

The cyberattack gave the hackers access to sensitive personal data of 850,000 customers. The compromised information includes the surnames, first names, phone numbers, SIM card numbers, PUK codes and tariff plans of the affected subscribers.

Fortunately, Orange Belgium stated that no critical data was compromised in this cyberattack. Passwords, email addresses, bank details and financial information were not affected, limiting the potential impact on customers.

The Warlock group behind the Orange Belgium cyberattack

The cyberattack was claimed by Warlock, an emerging ransomware group particularly active in 2025. Having surfaced publicly in June 2025, Warlock quickly established itself as a major threat by exploiting zero-day vulnerabilities in Microsoft SharePoint.

The group uses a sophisticated modus operandi, exploiting the “ToolShell” attack chain to break into systems through the CVE-2025-53770 and CVE-2025-53771 vulnerabilities. According to Trend Micro experts, Warlock has already claimed 49 victims worldwide, including major companies such as Orange and Colt.

Orange Belgium’s response to the cyberattack

As soon as the cyberattack was detected, the operator quickly activated its incident response plan. The teams immediately blocked access to the compromised system and strengthened existing security measures.

Orange Belgium also met its legal obligations by alerting the relevant Belgian authorities and filing an official complaint with the judicial authorities. The company notified all affected customers by email or text message, in line with GDPR requirements.

Link with the Orange France incident

This cyberattack came a few weeks after Orange Group was hit by a similar attack in France on 25 July 2025. Although both incidents are attributed to the Warlock group, Orange Belgium confirmed there is no direct link between the two cyberattacks.

The French incident had disrupted some management services and customer platforms, mainly in France, but Orange Group initially stated that no customer data had been compromised. This series of attacks reveals Warlock’s coordinated strategy against European telecom infrastructure.

Risk analysis after the Orange Belgium cyberattack

This cyberattack exposes customers to phishing and social engineering risks. With access to names, phone numbers and billing information, cybercriminals can craft particularly convincing fraud campaigns.

Orange Belgium has in fact warned its customers about impersonation attempts, explaining that a fraudster could use their data to pose as Orange Belgium and obtain sensitive information. The operator recommends extra vigilance with suspicious communications.

Protection tips after the Orange Belgium cyberattack

Following this cyberattack, stay alert to suspicious calls, texts or emails asking for personal information. Never share your credentials, passwords or bank details, even with someone claiming to be from Orange Belgium.

Check your bills and usage regularly for any unusual activity. If in doubt, contact Orange Belgium directly through its official channels rather than responding to dubious requests. Finally, strengthen the security of all your online accounts with unique, strong passwords.

Frequently asked questions