UK telecoms firm takes systems offline after cyber attack
The Warlock ransomware group said it was selling a million stolen documents
UK telecoms firm Colt Technology Services has been hit by a cyber attack that's been claimed by the Warlock ransomware gang.
The incident first unfolded on Tuesday 12th August, when the company detected issues on an internal system. In a blog post confirming the cyber attack, the company said the affected system is separate from customer infrastructure.
"We took immediate protective measures to ensure the security of our customers, colleagues, and business, and we proactively notified the relevant authorities," said the firm.
The company also took some systems offline, disrupting support services including the Colt Online customer portal and the company's Voice API platform, which allows customers to automate and manage their voice services.
Colt Technology Services asking customers to get in touch via email or phone.
It's not known just how the attack happened, but according to security researcher Kevin Beaumont, the entry point was probably sharehelp.colt.net, via the SharePoint vulnerability CVE-2025-53770.
This allows attackers to steal cryptographic keys from unpatched servers, enabling remote code execution (RCE) through malicious requests.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Beaumont said the attack appears to have been carried out by the Warlock ransomware group - a recent arrival on the scene, but a group that's already been linked to around a dozen confirmed cyber attacks, mainly in the government, finance, manufacturing, and technology sectors.
In this latest attack, said Beaumont, Warlock stole 'a few hundred gig' of customer data and documentation and posted a file list on a Russian Tor forum offering the data for sale.
The group said it was selling a million documents, including employee salary data, financial data, customer contract data, personal information on company executives and employees, network architecture, and software development data.
Beaumont said he has established that the file names are real, including, for example, customer documentation and performance reviews of Colt staff.
Colt is the latest telecoms firm hit by hackers
The incident is the latest in a string of attacks on telecoms companies across Europe, with French providers Orange and Bouygues Telecom both hit during the last month alone.
French cybersecurity agency ANSSI issued a warning about state-sponsored threats targeting the country’s telecommunications sector for espionage, saying there had been multiple compromises in recent years.
Similar attacks on US phone providers have been attributed to the China-linked Salt Typhoon hacking group.
"We’ve seen already this year that telecom is particularly vulnerable to attacks, and I think this WarLock attack highlights some recurring issues that telecom and large-scale network service providers are starting to see," commented Gabrielle Hempel, security operations strategist at Exabeam.
"There’s this operational ripple effect when you’re a service provider and support-layer services go down. Even though Colt claims its core network infrastructure is still intact, the outage of hosting, porting, and API services still disrupts customer trust and downstream operations."
Patch timelines need to improve, Hempel added, so that SharePoint RCE or similarly severe vulnerabilities for externally accessible systems dealt with within hours, not weeks.
"For critical infrastructure providers, RCE patch pipelines need to be prioritized and automated wherever possible for internet-facing services," she said.
"Essentially, in high-value and high-availability industries like telecom, security SLAs need to be as strict, if not stricter, than availability SLAs."
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
The six biggest security challenges coming in 2026In-depth What will be the main challenges businesses face in 2026 and what can they do to prepare?
-
Channel focus: All you need to know about Microsoft's partner programChannel Focus The veteran OS developer and vendor continues to advance its strategy, particularly in Azure cloud solutions and AI
-
NHS supplier DXS International confirms cyber attack – here’s what we know so farNews The NHS supplier says front-line clinical services are unaffected
-
LastPass hit with ICO fine after 2022 data breach exposed 1.6 million users – here’s how the incident unfoldedNews The impact of the LastPass breach was felt by customers as late as December 2024
-
Researchers claim Salt Typhoon masterminds learned their trade at Cisco Network AcademyNews The Salt Typhoon hacker group has targeted telecoms operators and US National Guard networks in recent years
-
Trend Micro issues warning over rise of 'vibe crime' as cyber criminals turn to agentic AI to automate attacksNews Trend Micro is warning of a boom in 'vibe crime' - the use of agentic AI to support fully-automated cyber criminal operations and accelerate attacks.
-
Cyber budget cuts are slowing down, but that doesn't mean there's light on the horizon for security teamsNews A new ISC2 survey indicates that both layoffs and budget cuts are on the decline
-
NCSC issues urgent warning over growing AI prompt injection risks – here’s what you need to knowNews Many organizations see prompt injection as just another version of SQL injection - but this is a mistake
-
Chinese hackers are using ‘stealthy and resilient’ Brickstorm malware to target VMware servers and hide in networks for months at a timeNews Organizations, particularly in the critical infrastructure, government services, and facilities and IT sectors, need to be wary of Brickstorm
-
AWS CISO Amy Herzog thinks AI agents will be a ‘boon’ for cyber professionals — and teams at Amazon are already seeing huge gainsNews AWS CISO Amy Herzog thinks AI agents will be a ‘boon’ for cyber professionals, and the company has already unlocked significant benefits from the technology internally.
