Cyberattack hits Orange Spain

On January 3, 2024, the mobile network provider Orange Spain disclosed it had suffered a security incident, now resolved, which significantly disrupted Internet access for its customers. A cybercriminal, who goes only by “Snow”, managed to log into the Ripe NCC account of an Orange Spain employee. Ripe NCC (Réseaux IP européens Network Communications Center) is the service that manages IP address routing in Europe.

Snow then hijacked the routing of a significant number of IP addresses on the Orange Spain network, blocking access to websites. The cybercriminal, whose motives remain unknown, got into the critical service by entering a simple password: “ripeadmin”. Indeed, Orange Spain had never activated two-factor authentication, which is optional on Ripe NCC.

The IP address management department encouraged users, in the press release reporting the incident, to change their passwords and activate two-factor authentication.