Colt Technology Services

Colt Technology Services, a UK-based telecom firm, suffered a cyberattack where the ransomware group **Warlock** (linked to LockBit and Babuk malware) breached its systems, exfiltrated sensitive data, and is now selling it on the dark web for **$200,000**. The stolen archives allegedly include **financial records, network architecture details, and customer information**, posing risks of phishing, identity theft, and wire fraud. The attack disrupted Colt’s services, forcing partial infrastructure shutdowns. SharePoint servers were likely the initial entry point, exploited via webshells. Colt is investigating the precise scope of the breach and notifying affected parties, while customers can request lists of exposed filenames. The incident underscores severe reputational, financial, and operational risks, with potential long-term consequences for trust and regulatory compliance.

Source: https://www.techradar.com/pro/security/colt-confirms-customer-data-stolen-as-warlock-ransomware-crew-auctions-off-details

TPRM report: https://www.rankiteo.com/company/colt-technology-services

"id": "col702082325",
"linkid": "colt-technology-services",
"type": "Ransomware",
"date": "8/2025",
"severity": "100",
"impact": "",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'Telecommunications',
                        'location': 'United Kingdom',
                        'name': 'Colt Technology Services',
                        'type': 'Telecommunications Provider'}],
 'attack_vector': ['SharePoint Server Exploitation', 'Webshell'],
 'customer_advisories': ['Dedicated call center for filename requests'],
 'data_breach': {'data_exfiltration': True,
                 'number_of_records_exposed': '~1,000,000 files',
                 'personally_identifiable_information': True,
                 'sensitivity_of_data': 'High (includes PII and financial '
                                        'data)',
                 'type_of_data_compromised': ['Financial Information',
                                              'Network Architecture Data',
                                              'Customer Information']},
 'description': 'Colt Technology Services, a UK-based telco firm, confirmed a '
                'cyberattack resulting in data exfiltration. The ransomware '
                'group Warlock claimed responsibility and is selling a '
                'database of ~1 million files (including financial, network '
                'architecture, and customer data) on the dark web for '
                '$200,000. The attack targeted SharePoint servers, likely via '
                'a webshell, disrupting services and forcing infrastructure '
                'shutdowns. Colt is investigating the precise nature of the '
                'compromised data and notifying affected parties.',
 'impact': {'brand_reputation_impact': True,
            'customer_complaints': True,
            'data_compromised': ['Financial Information',
                                 'Network Architecture Data',
                                 'Customer Information'],
            'downtime': True,
            'identity_theft_risk': True,
            'operational_impact': 'Partial infrastructure shutdown, service '
                                  'disruptions',
            'payment_information_risk': True,
            'systems_affected': ['SharePoint Servers']},
 'initial_access_broker': {'data_sold_on_dark_web': True,
                           'entry_point': 'SharePoint Servers',
                           'high_value_targets': ['Financial data',
                                                  'Network architecture data']},
 'investigation_status': 'Ongoing (determining precise nature of impacted '
                         'data)',
 'motivation': 'Financial Gain',
 'post_incident_analysis': {'corrective_actions': ['Added firewalls to '
                                                   'SharePoint servers']},
 'ransomware': {'data_exfiltration': True,
                'ransom_demanded': '$200,000',
                'ransomware_strain': ['LockBit (Windows)',
                                      'Babuk (VMware ESXi)']},
 'references': [{'source': 'BleepingComputer (via TechRadar Pro)'}],
 'response': {'communication_strategy': ['Status page updates',
                                         'Dedicated call center for customers '
                                         'to request exposed filenames'],
              'containment_measures': ['Shutting down parts of infrastructure',
                                       'Adding firewalls to SharePoint '
                                       'servers'],
              'incident_response_plan_activated': True},
 'threat_actor': 'Warlock (Chinese ransomware group)',
 'title': 'Colt Technology Services Data Breach and Ransomware Attack',
 'type': ['Data Breach', 'Ransomware Attack']}