A cyberattack compromised the personal data of around 850,000 Belgian customers, French telecoms operator Orange said Wednesday.

In an email sent to affected clients — including some POLITICO staff — Orange Belgium said hackers had gained access to names, telephone numbers, SIM card details, tariff plans and the Personal Unlocking Key (PUK) codes of users. No passwords, email addresses or financial information had been stolen, the company stressed.

“Orange Belgium has informed the relevant authorities and an official complaint has been filed with the judicial authorities,” the company said in a statement.

The group — which serves more than 290 million customers globally — warned that some services could be affected by its response to the incident, though it did not disclose the precise nature of the attack.

Orange’s handling of the incident was met with sharp criticism from some of Belgium’s cybersecurity community.

In a LinkedIn post, Inti De Ceukelaire, chief hacker at Belgian bug-bounty platform Intigriti, called the company’s response “very disappointing,” accusing Orange of following “the same old corporate PR playbook” to protect its brand rather than its customers.

De Ceukelaire warned that the dedicated information page published by Orange downplayed the real risks — such as SIM swapping and number theft — while shifting the burden onto users to guard against phishing.

The company also “subsequently downplay[s] the financial compensation claims stating that damage needs to be proven,” he added.

Another LinkedIn user, Koen Gabriels, wrote: “Sure, providing every affected customer with a new SIM card is expensive and quite the logistical operation, but it would prove to me that they are worthy of storing my data.”

The breach comes as European regulators and telecoms operators step up scrutiny of cybersecurity standards amid a rise in large-scale data leaks targeting critical infrastructure.

Orange, one of the biggest mobile service providers in both Europe and Africa, separately announced at the end of July that it had suffered a cyberattack affecting one of its internal systems.

Orange did not reply to POLITICO’s request for comment by the time of publication.