A ransomware breach has hit telecom operator Colt Technology, with various services from the U.K. company taken offline in the attack.

The incident began early last week, with the firm’s Colt Online customer portal and its Voice API platform still unavailable as of August 18.

Colt’s status page claimed the breach was detected on an internal platform, separate from its customer network.

While Colt reported it had taken “immediate protective measures to ensure the security of [its] customers, colleagues, and business,” a report per The Register suggested employees' salary details and personal information were leaked in the attack.

Ransomware group WarLock, which admitted responsibility on August 15, is reportedly selling one million Colt company documents for the price of $200,000, with the inclusion of colleague data unconfirmed at the time of writing.

Colt attack timeline

On August 14, cybersecurity analyst Kevin Beaumont reported internet scan data showing traffic from known malicious IP addresses trying to reach the firm’s Microsoft Sharepoint servers.

Colt later took those servers offline, and signs pointed to attackers having covertly installed web shells on them, malicious code that a bad agent uploads to a web server to enable remote control via a browser.

Public records also indicate the company tightened its European Union (EU)-level firewall rules on August 12, when it first warned customers about the issue.

Beaumont also suggested the breach was related to twin remote code execution (RCE) vulnerabilities in Sharepoint, specifically one tracked as CVE-2025-53770.

Palo Alto Networks' Unit 42 recently warned SDxCentral that the “high-severity, high-urgency threat” allowed attackers to bypass identity controls, including multifactor authentication (MFA) and single sign-on (SSO), to gain privileged access.

In its most recent update as of August 18, Colt wrote that it was “continuing to work tirelessly to restore the internal systems affected by the recent [cybersecurity] incident,” with customers advised to get in contact via email or phone.

The breach marks a rare cybersecurity concern for Colt.

The London-based firm’s reach spans 32,000 on-net buildings, and more than 230 cities across 40 countries.

Colt did earn secure access service edge (SASE) plaudits from industry trade group MEF in November 2024, meeting its standards in SD-WAN, secure service edge (SSE), and zero-trust capabilities.