On Wednesday, October 21, a major outage left millions of Orange and Sosh subscribers without mobile service for several hours. Calls, SMS and mobile data were disrupted across France. The following day, Orange said the incident was caused by a piece of equipment in its new core network and ruled out the possibility of a cyberattack or any connection to a PHP vulnerability.
A large-scale interruption to mobile services
The first reports appeared at around 11:20 a.m. Customers reported problems on outage-tracking platforms and social media. For many subscribers, their phones could no longer make calls, send SMS messages or connect to the Internet over the mobile network.
Orange quickly acknowledged the incident and said it was working to restore service. The outage affected the operator’s mobile network across France. Sosh, which uses the same infrastructure, was also affected.
The disruption lasted nearly ten hours, from late morning until early evening. It potentially affected around 21 million Orange and Sosh mobile customers in the country, although not all of them necessarily experienced the same problems at the same time.
Disrupted communications and everyday activities
The loss of network service prevented affected subscribers from contacting loved ones, using messaging apps or browsing the Internet without a Wi-Fi connection. The unavailability of calls could also make it difficult to contact certain services, particularly in an emergency.
The problems affected access to the mobile network, not just data services. Depending on the circumstances, customers were therefore unable to make calls or send messages, as well as losing their mobile connection. Devices using the Orange network experienced similar disruptions, whether they used an Orange phone or a Sosh line.
The stated cause: equipment in the new core network
In an update issued on October 22 at 11:52 a.m., Orange explained that the incident had affected a piece of equipment in its new core network. The operator said the problem had affected some of its subscribers in France.
The core network is a central component of mobile infrastructure. Among other things, it helps manage phones’ connections to the network and subscribers’ sessions. A failure at this level can therefore prevent customers from accessing mobile services, even when their phones are working normally.
Before this confirmation, an initial explanation had pointed to the rollout of a new core network associated with standalone 5G, sometimes called 5G SA. Orange markets this technology as 5G+. According to this theory, migrating some lines may have caused authentication and connection-management problems. Orange confirmed that equipment in its new core network was involved, without publicly detailing all the technical steps that led to the outage.
Why some subscribers lost access to 4G and 5G
Initial reports suggested that some customer sessions had been incorrectly managed during a migration. Lines switched to the new equipment may then have encountered authentication problems, leaving them unable to access mobile services, particularly over 4G or 5G.
Restoring service reportedly required several hours of work. The affected lines were reportedly resynchronized gradually, first individually and then in groups. This phased restoration helps explain why customers did not all regain network access at the same time.
A workaround was reported during the outage: some subscribers were able to restore their connection by forcing their phones to use 3G instead of 4G or 5G. However, this option depended on each customer’s circumstances and was not a substitute for a full network restoration.
An outage unrelated to a cyberattack or PHP vulnerabilities
Orange ruled out the possibility of a cyberattack. The operator also said the outage was not connected to the recently discovered PHP vulnerabilities. Measures taken to fix these vulnerabilities, including the temporary suspension of access to certain websites or applications, were separate from the mobile network incident.
Concerns had also circulated about other operators and Freeboxes, but reports of a similar problem at Free were denied. The initial information therefore points to Orange’s mobile infrastructure as the cause, rather than a general incident affecting multiple networks or a cyberattack.
Customers of mobile virtual network operators appear to have been spared
Several mobile virtual network operators usually use the Orange network, including Prixtel, Cdiscount Mobile and NRJ Mobile. Based on the information available at the time of the report, their customers did not appear to have been affected in the same way. The incident mainly affected Orange and Sosh subscribers, who share the operator’s mobile infrastructure.
The difference between the impact observed among these customers and that experienced by Orange or Sosh subscribers depends on the conditions under which the network is used and the services involved. The information provided does not specify in detail the mechanisms that would explain the apparent lack of disruption for some mobile virtual network operators.
A goodwill gesture announced for affected subscribers
Following the outage, Orange announced a goodwill gesture for affected customers. The measure is intended to compensate, at least in part, for the service interruption they experienced over several hours. The operator has not provided details of the exact terms of this compensation in the information available.
The incident highlights the importance of the core network to the everyday functioning of calls, SMS and mobile Internet. When a central piece of equipment fails, the effects can quickly spread to a large number of subscribers, even if their phones themselves are working properly.
