Colt UK Telco’s recovery from ransomware cyberattack expected to extend into November

The Warlock ransomware attack that began on August 12 disrupted Colt’s high-profile tech infrastructure, leaving critical platforms like the customer portal, network-as-a-service dashboard, and billing systems partially or completely offline, causing delays in invoices and payments

Colt Technology Services, a global provider of network and voice solutions, has announced that full recovery from a recent cyberattack is now expected to take until late November, following a ransomware incident that severely impacted its internal and customer-facing systems.

The attack, which began on August 12, was attributed to the Warlock ransomware group, known for targeting high-profile tech infrastructure. Despite efforts to restore operations, several critical platforms remain partially or completely offline, including Colt’s customer portal, network-as-a-service dashboard, and key hosting APIs. Billing systems have also been affected, resulting in delays in issuing invoices and collecting direct debit payments.

Colt confirmed that its core network infrastructure has been stabilized, and foundational recovery tasks have largely been completed. However, restoring customer services is being handled in phases, prioritizing stability and data security.

Ongoing threats and regulatory notifications

As investigations continue, Colt has partnered with external cybersecurity specialists to review its Business Support Systems (BSS) and Operational Support Systems (OSS). While no evidence of compromise was found in OSS, several customer platforms are still under assessment.

The Warlock group has claimed responsibility and reportedly listed stolen data for auction on a leak site, indicating a potential double extortion tactic—encrypting data while threatening public exposure if ransom demands go unmet. Colt has not confirmed what, if any, customer data was stolen.

In response, the company has filed over 75 regulatory and legal reports across 27 countries, and continues to share regular updates with customers regarding system status and recovery timelines. While some services are operational again, full functionality—particularly for customer-facing platforms—remains weeks away.