Colt, a UK-based telecommunications provider, was targeted by the emerging WarLock ransomware group, which claimed to have exfiltrated over one million sensitive documents. The stolen data allegedly includes executive emails, employee salary details, financial records, customer contracts, internal personal information, network architecture files, and software development documents. The group advertised the data for sale on a Russian cybercrime forum for $200,000, signaling a high-stakes breach with potential financial, operational, and reputational fallout. Colt acknowledged the incident, confirming system disruptions and ongoing investigations with third-party cybersecurity experts to restore impacted internal systems. While the company did not confirm the data theft, the nature of the exposed information—spanning employee, financial, and proprietary technical data—suggests severe internal and external risks. Experts criticized Colt’s reactive posture, highlighting vulnerabilities in threat detection against advanced ransomware tactics. The attack underscores the critical exposure of service providers, whose compromised networks can enable further intrusions into customer environments.

Colt Technology Services, a multinational telecommunications provider, experienced a cyber incident that disrupted its customer portal (Colt Online) and Voice API platform for multiple days starting August 12, 2024. The attack targeted an internal system, separate from customer-facing infrastructure, with no confirmed compromise of customer or employee data. However, the incident forced Colt to proactively take systems offline, causing service outages and forcing customers to rely on email or phone support instead of online tools. Investigations suggested potential exploitation of SharePoint servers, with indicators of webshell implants and suspicious IP activity linked to cybercriminals. Firewall protections were urgently deployed across Colt’s EU infrastructure. While the company assured authorities and customers of containment measures, the prolonged disruption—including the unavailability of critical platforms—highlighted operational vulnerabilities. Colt’s response involved third-party cybersecurity experts and round-the-clock restoration efforts, though full recovery remained pending as of the latest updates. The financial or reputational fallout was not quantified, but the incident underscored risks to business continuity and customer trust in a sector reliant on uninterrupted digital services.

Louisiana State Servers Disabled, CyrusOne Hit by REvil Ransomware in Latest Wave of Attacks In a proactive security measure, Louisiana’s Office of Technology Services temporarily disabled state servers, disrupting email, websites, and online applications for multiple agencies. Governor John Bel Edwards confirmed the move was a precaution to prevent the spread of ransomware, following a pattern of attacks targeting government entities and school districts over the summer. Meanwhile, data center provider CyrusOne confirmed that six of its managed service customers primarily in its New York data center experienced outages after a REvil ransomware attack encrypted devices on their networks. The company clarified that its colocation and network services remained unaffected, though an investigation with third-party experts is ongoing. Attackers left a ransom note, stating they had "the best specialists" to restore files, a tactic consistent with REvil’s operations. The incidents are part of a broader surge in ransomware activity. Since October 1, at least 15 U.S. organizations including healthcare networks, municipalities, and police departments have been targeted, according to research from Armor. Earlier this year, Texas declared a state of emergency after a coordinated REvil attack crippled local governments, though critical services were later restored. Security firm McAfee analyzed the malware, noting its sophisticated design, which executes rapidly to encrypt files while obfuscating Windows API calls to evade detection. The REvil strain, active since April, has been linked to multiple high-profile attacks, including those on managed service providers (MSPs). This year alone, 13 MSPs or cloud providers have fallen victim to ransomware, underscoring the growing threat to third-party infrastructure. Louisiana’s and CyrusOne’s responses highlight the increasing adoption of preemptive shutdowns to contain ransomware, even as attackers refine their tactics to maximize disruption. Law enforcement is assisting in the CyrusOne investigation, though no further details on attribution or ransom demands have been disclosed.