UK-based telecommunications firm Colt Expertise Companies is coping with a cyberattack that has triggered a multi-day outage of among the firm’s operations, together with internet hosting and porting companies, Colt On-line, and Voice API platforms.
The British telecommunications and community companies supplier disclosed that the assault began on August 12 and the disruption continues as its IT employees works across the clock to mitigate its results.
Based in 1992 as Metropolis of London Telecommunications (COLT) and purchased by Constancy Investments in 2015, Colt is a serious telecommunications service supplier working in 30 international locations throughout Europe, Asia, and North America. The corporate employs 75,000 km of fiber networks linking 900 information facilities.
Companies nonetheless offline
Initially, the corporate introduced a “technical situation” with out confirming a cyber incident. Nevertheless, the character of the occasion was communicated in subsequent standing updates.
The assault compelled the agency to take particular techniques offline as a protecting measure, which affected the operations of help companies, together with Colt On-line and the Voice API platform.
Buyer communication by on-line portals is at present unavailable, and purchasers are suggested to contact Colt by e mail or cellphone and count on slower-than-usual responses.
The corporate underlined that the impacted techniques are help companies, not the core buyer community infrastructure.
As of at present, there is no such thing as a estimation for restoring affected techniques and operations.
Colt says it has notified the authorities concerning the incident with out offering any particulars concerning the perpetrators or the kind of assault.
WarLock claims the assault
A risk actor utilizing the alias ‘cnkjasdfgd’ and claiming to be a member of the WarLock ransomware gang claimed the assault and supplied to promote for $200,000 a batch of 1 million paperwork allegedly stolen from Colt.
A number of information samples have additionally been revealed to show the validity of the recordsdata. Based on the risk actor, the stolen recordsdata embrace monetary, worker, buyer, and govt information, inner emails, and software program growth data.
Supply: KELA
Though the telecommunications firm didn’t disclose the reason for the breach, safety researcher Kevin Beaumont says that the hacker doubtless managed to realize preliminary entry by exploiting a distant code execution vulnerability in Microsoft SharePoint tracked as CVE-2025-53770.
The safety situation has been exploited as a zero-day since no less than July 18 and is taken into account crucial in severity. Microsoft addressed it in a safety replace on July 21.
Based on Beaumont, the hackers stole a number of hundred gigabytes of recordsdata with buyer information and documentation.
BleepingComputer has contacted Colt to ask for verification of those allegations, and a spokesperson despatched us the under remark:
“We’re conscious of claims relating to the cyber incident. We’re at present investigating these claims.”
“Our technical crew is concentrated on restoring the interior techniques impacted by the cyber incident and is working carefully with third-party cyber specialists. We’re grateful for our prospects’ understanding as we work in the direction of a decision to repair the impacted inner techniques.” – Colt spokesperson
Replace 8/15 – Added remark from Colt
46% of environments had passwords cracked, almost doubling from 25% final 12 months.
Get the Picus Blue Report 2025 now for a complete take a look at extra findings on prevention, detection, and information exfiltration tendencies.