Overview

• Hosting, porting, Colt Online and the Voice API have been down since August 12 with no estimated time for restoration.
• A user claiming affiliation with WarLock ransomware is selling roughly one million Colt files for $200,000 and has released about 400,000 documents as proof.
• Researcher Kevin Beaumont traced the breach to CVE-2025-53770 in Microsoft SharePoint and noted pre-attack scanning and possible webshell implants.
• Colt maintains its core network infrastructure was unaffected, has notified authorities and engaged external cyber experts, but has withheld detailed technical findings.
• Customers are resorting to email and phone support channels as the investigation continues and affected platforms stay offline.