Claimed Orange Data Leak: What We Know (and What's Still Unconfirmed)

A hacker claims to have stolen roughly 6GB of internal documents via Orange's Agir ticketing portal — technical tickets, overseas customer data, infrastructure secrets. Six independent French-language outlets cross-check the same numbers. Orange itself has confirmed nothing.

October 27, 2026 · SunuCyberSecurity Team

Sources: Fuites Infos, MacGeneration, KultureGeek, Alloforfait, FrenchBreaches, cyberattaque.org — full list at the end of this article

On October 23, 2026, someone using the handle 0xRune posted on a specialized forum a message titled "Orange Agir Portal," complete with the operator's logo, claiming to hold over 6GB of internal documents. As an editorial policy, this blog never links to platforms where a leak is claimed — the same rule already applied to our ransomware-claims coverage. What follows is a synthesis of what independent specialized outlets were able to verify by analyzing the archive itself, not a relay of the original post.

What is the "Agir" portal?

According to Fuites Infos' analysis, the claimed archive concerns Agir, Orange's internal project- and ticket-tracking tool — a Jira-type platform used for day-to-day operational tracking, not a public-facing production system. The repository reportedly contains around 20,700 tickets from 245 internal projects, covering network, information systems, billing, and overseas territories, spread across roughly 3,940 directories.

That distinction matters: an internal ticketing tool is not the same attack surface as a production customer database. What ends up in it depends entirely on what employees pasted into it over time — screenshots, attachments, configuration snippets — not a controlled data schema.

What's reportedly actually exposed

Per Fuites Infos, the most detailed analysis published so far, the archive reportedly contains, beyond the technical tickets themselves:

• Roughly 8,200 full customer records (name, address, mobile number, phone ID) for customers in the French Antilles and Guiana, found in mobile-insurance enrollment attachments;
• Roughly 93,000 partial records tied to direct-debit mandates — masked bank details, mandate references, amounts, dates;
• Around 300 employee absence schedules, with health-related reasons, under internal IDs;
• Infrastructure secrets cited in technical tickets: IP addresses, authentication tokens, configuration passwords.

cyberattaque.org also mentions at least one item it judged sensitive enough not to publish in detail — the same editorial caution we apply ourselves to this kind of content.

What's reportedly NOT exposed

cyberattaque.org, which counted 29,516 files (versus 29,519 for Fuites Infos — a minor recount discrepancy between two independent analyses, not a substantive contradiction), is explicit on this point: no classic, bulk-exported customer database was found in the archive. No complete application source code either — only a handful of isolated scripts. Nothing so far indicates that production systems (live network, active billing) were themselves compromised: the archive appears to concern an internal support tool, not the core infrastructure. The personal data detailed above was found by Fuites Infos by digging into specific attachments within individual tickets, not in a structured export — a real leak, but a different kind of one than a stolen customer database.

What we know — and what we still don't

No technical proof of how the data was obtained has been provided by 0xRune. MacGeneration says so explicitly: specialized press is deliberately avoiding the word "hack" in its strict sense, since there's no way to verify how these files were actually acquired. Orange has issued no public statement, to our knowledge, either confirming or denying the incident.

The numbers vary slightly between sources — 29,503, 29,516, or 29,519 files depending on the count, "over 6GB" to roughly 6.5GB for the size. These are minor methodology gaps between independently-run analyses rather than a substantive contradiction: several teams appear to have had access to the same dataset and each recounted it separately — a sign of consistency, not inconsistency.

One thing not to confuse: in 2025, Orange Romania suffered a separate leak, claimed by a different hacker ("Rey"/HellCat, roughly 380,000 emails) and confirmed by Orange at the time. This incident involves an internal portal of the group in France, a different handle, and entirely different numbers — the two shouldn't be conflated in any risk assessment.

Why this matters for francophone Africa

Orange is one of the continent's largest telecom and mobile-money operators — Orange Sénégal, Orange Mali, Orange Côte d'Ivoire, Orange Money across much of West and Central Africa. Based on available sources, this specific incident concerns the group's internal French infrastructure (a ticketing tool, overseas customer data): nothing so far indicates that the African subsidiaries' own systems are exposed.

But the nature of what's exposed is a universal risk category, not an Orange-specific quirk: infrastructure secrets and personal data circulating in support-ticket attachments, outside the monitoring applied to real databases — a blind spot that any organization running an internal Jira/ITSM-type tool can share, telecom operator or not, in francophone Africa or anywhere else.

What to do about it

Sources and methodology

Fuites Infos (most detailed analysis, overseas customer data breakdown) · cyberattaque.org (independent file count, no classic customer database found) · MacGeneration (caution on the term "hack," no technical proof) · KultureGeek · Alloforfait · FrenchBreaches (identifies the 0xRune handle, publication date). Claim published October 23, 2026, unconfirmed by Orange at the time this article was published. Data as of October 27, 2026 — the situation may evolve; we will update this article if Orange issues an official statement.

Related reading

Check your own exposure

A free scan, in minutes, no credit card required.