Orange.com targeted by Babuk2 ransomware group

• Ransomware group: Babuk2
• Country: France
• Sector: Technology
• Announcement date: March 16, 2025

Babuk2 claims massive data theft from Orange.com

The Babuk2 ransomware group has announced a significant data breach involving Orange.com. According to a post published on a leak site on March 16, 2025, the threat actors claim to have successfully exfiltrated 4.5 TB of data belonging to the organization. The group asserts that they gained access to sensitive information pertaining to Orange.com and its specific operations located in Romania.

This incident follows a common pattern observed in modern cybercrime, where ransomware groups move beyond simple encryption to focus on data theft. This method, often referred to as double extortion, involves stealing sensitive information and threatening to release it publicly to pressure the victim into paying a ransom. While the specific ransom demand for this incident has not been disclosed, the group has issued a direct threat, stating that they may publish 1 TB of the stolen data if their demands are not met.

Detailed scope of the alleged data exfiltration

The claims made by the Babuk2 group suggest a highly comprehensive breach of the organization's digital infrastructure. The group alleges that the stolen information encompasses a vast array of sensitive categories, ranging from technical assets to highly personal user information. The breadth of the claimed data suggests that the attackers may have gained deep access to various internal systems and databases.

The specific types of data the group claims to have acquired include:

• Customer records
• Source code
• Internal documents
• Invoices
• Contracts
• Projects
• Tickets
• User data
• Employee information
• Messages
• Credit card details
• Personally identifiable information (PII)
• Call logs

The inclusion of such diverse data types, particularly source code and internal communications, indicates a potential compromise of both intellectual property and operational security.

About Orange.com

Orange S.A. is a French multinational telecommunications corporation. It stands as one of the world's largest telecommunications operators, providing a wide range of services including mobile, landline, internet, and corporate communication services.

Potential impact and security implications

The alleged breach of Orange.com carries significant risks for both the organization and the individuals whose data has been targeted. For customers and employees, the exposure of personally identifiable information (PII), credit card details, and call logs could lead to severe consequences, such as identity theft and highly targeted phishing attacks. When attackers possess detailed user data and internal messages, they can craft convincing social engineering campaigns that are much harder for individuals to detect.

From a regulatory and corporate standpoint, the nature of the data involved—particularly involving European operations—may trigger legal processes under the General Data Protection Regulation (GDPR), which is applicable across the European Union. Such regulatory scrutiny often follows large-scale breaches involving personal user data. Furthermore, the organization may face negative impacts regarding its operational continuity and its reputation management in the global market.

While information regarding the Babuk2 group remains limited, their use of leaked data as leverage is a hallmark of contemporary ransomware operations. For organizations in the technology and telecommunications sectors, an incident of this alleged volume may necessitate a comprehensive re-evaluation of existing data security processes and defensive architectures. Strengthening data encryption, implementing strict access controls, and enhancing monitoring capabilities are standard defensive steps used by organizations to mitigate the risks posed by such sophisticated threat actors.