31st July 2025 Cyber Update: Metricon Homes Ransomware Attack and Orange France System Breach

Update: The Qilin ransomware operation has listed Metricon Homes as a victim on its darknet leak site, claiming to have stolen 128 gigabytes of data containing over 98,000 files from the home builder. The attack was discovered on July 24, 2025, with the estimated attack date being July 21, 2025.

The compromised data includes confidential financial documents, proprietary architectural plans, internal marketing strategies, company credits and employee details, credit card receipts, finance and HR information, profit and loss statements, and staff salary and commission rate details. The hackers have threatened to fully publish the data within seven days if their demands are not met.

“This issue was swiftly contained with the support of external experts. Metricon can confirm that there has been no impact to the safety of our operations, and construction activity has continued without interruption,” - Metricon Homes spokesperson.

Why it Matters: This attack represents a significant threat to Australia's construction sector, as Metricon's position as the country's largest home builder means the breach could expose sensitive information affecting thousands of customers, suppliers, and employees. The stolen architectural plans and financial documents could provide competitors with substantial strategic advantages while compromising customer privacy and business operations.

The incident highlights the vulnerability of critical infrastructure companies to ransomware attacks, with Qilin being identified as the third-most active ransomware group globally with 625 claimed victims since August 2022.

Update: Orange detected a cyberattack on one of its internal information systems on Friday, July 25, 2025, and announced the incident publicly on Monday, July 28. The company's cybersecurity subsidiary, Orange Cyberdefense, was immediately mobilized to isolate the potentially affected services and limit the impacts of the breach.

The response efforts resulted in disruption of certain services and management platforms for some corporate customers and consumer services, primarily in France. Orange has filed a complaint about the attack and alerted relevant authorities, though the company has declined to provide further details about the nature of the incident for security reasons.

Why it Matters: This attack on France's largest telecommunications provider occurs amid heightened concerns about state-sponsored threats targeting the country's telecommunications sector. The French cybersecurity agency ANSSI recently warned about multiple compromises in the telecommunications industry, including suspected state-sponsored actors compromising mobile network cores and satellite communications infrastructure with the intent to intercept communications of specific targets.

The timing and scale of the Orange attack, affecting a company serving 290 million customers globally, raises questions about potential espionage activities similar to the Salt Typhoon breaches reported in the United States. The incident underscores the critical vulnerability of telecommunications infrastructure to sophisticated cyber threats and the potential for widespread service disruptions affecting both civilian and business communications.