The Babuk cybercrime network claims to have hacked the French telecommunications company Orange again on Sunday and stolen “all information related to orange.com and orange.ro in Romania,” threatening to release 1TB of data “if they don’t want to negotiate with us,” Cybernews reported.
Orange Romania officials, however, claim that so far they have not received any requests for negotiation from the Babuk hackers, who claim to have extracted 4.5TB of personal data, a large amount of data. Both Orange and the National Cybersecurity Directorate (DNSC) experts have analyzed the published file samples, and the link provided leads to the same archives extracted in the recent cyberattack on Orange Romania, the company and DNSC said Tuesday.
“According to information published yesterday in the public domain, an attacker claims to have extracted data belonging to orange.com and orange.ro. Up to this point, we have not been contacted by potential attackers and have not received any requests for negotiation related to a potential cybersecurity incident. We have seen the post you are referring to, our experts have analyzed the published file samples, and the indicated link refers to the same archives exfiltrated in the recent cyber attack on Orange Romania. We continue to monitor the situation together with the Orange Group and the National Cyber Security Directorate. We will return with any relevant information, if necessary,” Orange said in a press statement.
Also on Tuesday, a similar message was sent by the National Cyber Security Directorate (DNSC), which emphasizes that “specialists from the DNSC team analyzed the published file samples, and the indicated link refers to the same archives extracted in the recent cyber attack on Orange Romania.”
The 4.5 TB (terabytes) of information would be about 670 times more than the 6.7 GB (gigabytes) of personal data officially confirmed to have been extracted by hackers in the previous attack. 1TB means 1000 GB. As of December 31, 2024, Orange provided mobile services to 9.3 million users (not including active SIMs), fixed broadband internet to one million users and cable and satellite television services to 1 million customers.
The hackers claim to have extracted 4.5 TB of “highly detailed” information, such as email addresses, customer records, source code, internal documents, invoices, contracts, projects, tickets, user data, employee data, messages, credit cards, call logs, and other personally identifiable information.
On March 10, 2025, the National Cyber Security Directorate (DNSC) revealed the first conclusions of the investigation into the cyber attack that took place last month at Orange Romania. The attackers managed to extract 6.7 GB of data, after compromising the access data (username and password) for an internal application of the largest telephone, internet and TV company in the country.
DNSC had previously announced that it had launched an investigation into Orange Romania following last month’s cyber incident that affected government institutions, city halls, schools, hospitals, banks, insurers, transport and energy companies.