IColt Technology Services, an international provider of telecommunications and business services, has been dealing with the aftermath of a ransomware attack since mid-August. According to its own statements, the attack was carried out by the hacker group WarLock, which claims to have stolen more than a million internal documents.

The disruptions first occurred on 12 August and were initially communicated as technical problems. Two days later, Colt officially confirmed a security incident. Among other things, hosting and porting services, online access and voice APIs are affected. To prevent the spread, several systems were shut down, leading to outages in various services. Colt emphasises that the compromised systems are separate from the customer infrastructure.

Offers have since appeared on the darknet to sell the stolen data for around 200,000 US dollars. The data is said to include financial documents, internal emails and employee and customer data. Experts warn that this could pose significant risks to business customers.

Colt is currently working with external cybersecurity teams to restore its systems. Some support channels remain limited, and customers are being directed to alternative contact methods. Network monitoring for customers continues, but requires increased manual intervention. It is not yet known how the attackers were able to penetrate the systems.

Colt also operates in Germany, offering SIP trunking, UC solutions and international voice services, among other things, and maintains close cooperation with Deutsche Telekom. The incident underscores that even established providers with high security standards can be targets of ransomware attacks. Companies should therefore regularly review their own protective measures and continuously strengthen their security architecture in collaboration with their providers.