A hacker claims to have recovered more than 6 GB of documents related to Orange tools and technical infrastructure. The sample examined contains nearly 30,000 claimed files, including exports of computer projects and data on electrical equipment.
Almost 30,000 files associated with the Agir d’Orange portal
A hacker whose nickname is 0xRune claims to have 29,503 files distributed in 3,940 directories, for a volume greater than 6 GB. The documents refer in particular to IT project management, software development, technical incidents and Orange’s internal processes.
Violations reviewed an initial sample of 102 files, which primarily included screenshots related to Jira, a project tracking tool, as well as spreadsheets, a PDF, and a Word document. The names of several files include dates ranging from October 2025 to September 2026. These items are consistent with a collection of technical working documents, but are not sufficient to prove their provenance or the conditions in which they would have been recovered.
Among the documents analyzed is a spreadsheet containing approximately 435,670 lines dedicated to the characteristics of the equipment. Other files describe electrical measurements, including voltage, current, power, battery temperature, and power system run time. A Word document also details data exchanges between two applications, called NewPerf and GCEC, and mentions exports of up to 250,000 measurement lines.
If their internal origin were confirmed, these documents could be of interest to people seeking to understand the technical organization of certain systems. Trace tickets, architectural diagrams, or information about exchanges between applications can reveal dependencies and maintenance procedures. However, the analysis does not demonstrate either an acquisition of equipment or operational access to Orange’s infrastructure. Nor does it allow us to know if the facilities described continue to operate under the same conditions.
An intrusion in Orange yet to be confirmed
The main unknown remains how these documents were obtained. Possibilities include extraction from a project management tool, compromised credentials, or inadvertent file exposure, although none have been established. The presence of Jira references does not prove that this tool has been hacked or that the Agir portal itself has been compromised.
The sample examined does not reveal evidence of a massive leak of personal customer data, such as subscriber base, passwords or banking details. However, some documents may contain professional information about employees or service providers. The total volume announced, the sensitivity of the files and their origin remain to be verified. Orange has not yet made any public comments.
In any case, the historic operator had a bad week. Between its major breakdown on October 21, problems with PHP vulnerabilities and now this…
