Orion Telecom Technologies Orion

History

2025

Losses from a large-scale cyber attack amounted to 66 million rubles - personal data of subscribers were stolen

The financial losses of the Orion Telecom Internet provider, which serves subscribers in the regions of Siberia, from a massive cyber attack could amount to 66 million rubles. The hacker invasion also led to the leakage of personal data of the company's subscribers, which became known in mid-October 2025.

The incident in question occurred in June 2025. Initially, it was reported that the infrastructure of Orion Telecom was subjected to a massive DDoS attack. Key elements of the network were disabled: the operation of Internet channels, television and telephony, a contact center, a provider's website and a mobile application were disrupted. Subscribers were affected in all 13 cities of the operator's presence, including Krasnoyarsk Kansk, Zelenogorsk,,, Zheleznogorsk, Abakan Minusinsk Sayanogorsk,,,,, and Chernogorsk. Irkutsk Bratsk Novokuznetsk After Prokopyevsk Kiselyovsk the invasion, the provider stated the following:

𝓲

Фото: Orion Telecom Telegram Channel

Our company is faced with a large-scale cyber attack by a hacker group for our supporting position on SVO and the integrity of the country. No facts of personal data leakage were recorded. We notified Roskomnadzor and the relevant authorities about the detection and elimination of the consequences of computer attacks on the company's information resources.

However, according to SecPost, it subsequently turned out that the attackers stole about 500 thousand lines of personal data of the company's customers, including their names and names, passwords, logins, passport information, etc. This information was stolen before the DDoS attack on the provider.

The investigation also showed that abnormal activity in the Orion Telecom network began on May 30, 2025: it is associated with the account of an employee dismissed in 2022. According to the provider, attackers could find the data of a former employee on the customer's web servers, or the employee himself transferred this information to hackers. It is noted that at the final stage of the attack, the attackers had full control over the Orion Telecom infrastructure, and when they "noticed" traces of presence, they removed entire provider servers.^[1]

Restoring the Internet 18 days after a cyber attack

Krasnoyarsk Internet provider Orion Telecom fully resumed providing its services to subscribers 18 days after the cyber attack. All network switches are functioning normally, the city is operating normally. Information about this in June 2025 was published in the company's official public on VKontakte. Internet connection has been restored in all cities of presence of Orion Group of Companies. The company said that all inconvenience to subscribers will be compensated. ^[2]

DDoS attack, which caused subscribers to have problems with Internet access

Orion Telecom was subjected to a powerful DDoS attack on the night of June 12, 2025, as a result of which subscribers from the Krasnoyarsk Territory, Khakassia and the Irkutsk Region lost access to the Internet and television. The network and server infrastructure of the provider was disabled by cybercriminals, which led to a large-scale failure in the operation of telecommunications services.

According to prmira, the Ukrainian hacker group BO Team took responsibility for the cyber attack. The attackers explained their actions by the fact that the company supports a special military operation and cooperates with defense enterprises.

𝓲

Фото: Freepik

The attack disrupted telecommunications services in several regions of Russia. Orion Telecom users in the Krasnoyarsk Territory, the Republic of Khakassia and the Irkutsk Region faced a complete shutdown of the Internet connection and digital television.

On the evening of June 12, 2025, the company announced a partial restoration of television broadcasting. In Krasnoyarsk, Kansk and Abakan, the broadcast of the first 20 television channels resumed, which was the first step towards the restoration of communication services.

On June 13, 2025, Orion Telecom management issued an official statement about the cyber attack. In the document, the company promised the complete restoration of Internet services in all four affected regions of Russia within one to two days.

On June 15, 2025, the provider issued a new statement acknowledging the serious scale of the hacker attack. The company's management reported that cybercriminals disabled key elements of the telecommunications network.

Orion Telecom engineers quickly rebuilt the architecture of the network infrastructure and connected some users to the Internet. It is planned to connect the remaining subscribers in stages by zones and address segments.

On June 16, 2025, the company issued another statement in which it acknowledged that the recovery had dragged on longer than initial expectations. The provider's management did not specify the exact timing of the full resumption of Internet services.^[3]

2024: Orion Telecom complains to authorities about harassment of company on regional TV channel

At the end of May 2024, the Orion-Telecom provider, which provides services in the Krasnoyarsk Territory, complained to the authorities about the harassment of the company. The conflict arose with the organization "Television Company Channel 8," with which business relations were previously maintained.

Reportedly, employees of the Orion-Telecom provider sent an open letter to the Governor of the Krasnoyarsk Territory Mikhail Kotyukov, Chairman of the Legislative Assembly Alexei Dodatko, Mayor of Krasnoyarsk Vladislav Loginov and Chairman of the City Council Natalya Firyulina. The document says that Orion-Telecom and TV Channel 8 (headed by City Council deputy Ivan Golovkin) collaborated for a long time. In particular, the operator provided broadcasting of the channel on its cable network.

𝓲

Фото: Unsplash

The letter says that on September 16, 2021, the license for broadcasting the First Consumer TV channel, with which TV Company Channel 8 works, was canceled by the Arbitration Court of the Krasnoyarsk Territory at the suit of Roskomnadzor. Despite this, TV Channel 8 continued broadcasting the channel, which is a violation of the requirements. As soon as Orion Telecom management became aware of this, the provider was forced to disconnect First Consumer from broadcasting on the cable network in accordance with the law. After that, according to the letter, Golovkin began harassing the provider.

For several weeks, starting with 22.04.2024, stories with unreliable and unverified, simply false information have been published on Channel 8 every day. As we see it, the purpose of this campaign is revenge on Nemirovsky M. S. [Maxim Nemirovsky, the founder of Orion Telecom] for depriving the leadership of Channel 8 of material benefit, since tele-stores bring very good money to TV companies broadcasting them, the letter says.

Orion-Telecom sent statements to the Office of the Federal Antimonopoly Service for the Krasnoyarsk Territory on unfair competition and the Yenisei Department of Roskomnadzor on prosecution for unlicensed activities. The authors of the letter ask officials to take the necessary measures in connection with the current situation.^[4][5][6][7]

Notes