- Incident Timeline
- On August 12, 2025, Colt Technology Services first detected disruption in some customer support services due to a cyber incident.
- By August 13, Colt confirmed that its Voice API platform, used by customers to automate and manage voice services, was also taken offline.
- As of August 15, critical services—including the customer portal (Colt Online)—remain unavailable.
- Nature of the Attack
- The attack primarily targeted Colt’s internal systems, reportedly separate from customer-supporting environments.
- Colt stated there is currently no evidence that customer or employee data was accessed.
- Protection and Mitigation Steps Taken
- Immediate Action: Systems believed to be affected or at risk were proactively taken offline as a protective measure, causing customer support portals and voice platforms to become unavailable.
- Notification: Relevant authorities were promptly notified as required by regulatory frameworks and incident response best practices.
- Engagement with Experts: Colt brought in third-party cybersecurity experts to assist with response, investigation, and recovery.
- Technical Response: Focus has been on restoring core systems, with teams working continuously to resume normal operations.
- Customer Communication: Colt continually updates customers, advising them to use alternative support channels (phone/email) while platforms are down.
- Source and Technical Indicators
- According to independent security researcher Kevin Beaumont, scans of internet-facing infrastructure revealed multiple connections from IP addresses associated with cybercriminals to Colt’s SharePoint servers.
- Webshells—malicious scripts often used for persistent remote access—were believed to have been implanted on these servers.
- Colt’s technical response included pulling the affected SharePoint servers offline and implementing additional firewall protections (especially for EU infrastructure) on the day issues were first disclosed.
- Current Status
- Restoration work is ongoing, with Colt working “around the clock” to return critical systems to service.
- Customers still cannot access Colt Online or the Voice API, but the company is providing alternative support channels and apologizing for the inconvenience.
Key Takeaways
- Immediate Steps Taken: Disconnection of at-risk systems, engagement with authorities and third-party experts, focus on containment and restoration, customer guidance, and transparent communication throughout the incident.
- Source of Attack: Likely originated via exposed SharePoint servers, based on evidence of cybercriminal scanning activity and subsequent implantation of webshells. Exact attribution and vulnerability exploited remain unconfirmed.
- Impact: Significant service interruption, but so far, no evidence of customer or employee data breach.
