If You Are an Orange Romania Customer, Your Data Was in This Leak

HEROIC found 333,557 records in Orange on 24-Feb-2025, exposing email addresses, phone numbers, subscription details, partial credit card information, and a batch of internal Orange Romania documents.

Why This Orange Romania Breach Is Dangerous for You

If you have ever been an Orange Romania subscriber, this leak is something you should act on today. The data was posted to a well known hacking forum on February 24, 2025, which means it is already circulating across Telegram channels and fraud marketplaces. You are not watching a distant breach happen. You are potentially a row in the file.

The structure of the data is what makes it especially useful for attackers. Many email addresses in the dump follow the format [phone number]@as1.romtelecom.net, which means your phone number is effectively your email. That turns every SMS phishing attempt, SIM swap, or voice scam into something far more convincing because the attacker already knows the pairing.

What Was Exposed in Orange

• 333,557 customer records dated 24-Feb-2025
• Email addresses including the [phone number]@as1.romtelecom.net pattern
• Phone numbers tied directly to each subscriber account
• Subscription details covering plan and billing information
• Partial credit card data, including card type, last four digits, expiration date, and issuing bank
• A significant volume of internal Orange Romania documents
• Breach type is a Database compromise, with the data in French

Why This Matters

You probably think partial card numbers are safe. They are not, in this context. Knowing the last four digits, expiration date, and issuing bank lets a scammer call you pretending to be your card issuer and read those details back to you as proof of identity. That is the exact social engineering playbook fraud teams have been tracking for years. When the caller also knows your phone number, your Orange plan, and your email, the call sounds real.

The internal documents are a second concern. They can expose Orange's own processes, employee contacts, and account handling rules. That information feeds more effective impersonation attacks against customer service lines, where the attacker can mimic the internal language staff expect to hear.

How Telco Database Breaches Like This Happen

Telecom operators are prime targets because a single customer table contains identity, financial, and contact data in one place. Attackers usually get in through an unpatched billing portal, a third party support contractor, or stolen employee credentials from a previous infostealer log. Once inside, they export large sections of the customer table and upload the archive to a forum for resale or reputation.

The posting of internal documents alongside customer data is a signal that the attacker had deeper network access than a pure database dump would suggest. That raises the likelihood of follow on activity from the same group.

Check If You Are Affected

HEROIC monitors over 400 billion compromised records across public and dark web sources, including breach postings on the forum where the Orange Romania data first surfaced. A single free scan tells you whether your email, phone number, or card fingerprint appears in this leak or in any connected dataset. If you are an Orange Romania customer, scan now and rotate your email passwords, alert your bank, and set SIM swap protections with your carrier.