Orange Spain outage: DNS failure linked to unprotected RIPE account

No internet in Spain: Orange's DNS outage

During one afternoon, much of the country discovered that its connectivity hinged on poorly protected credentials. The Orange service outage left numerous customers unable to load web pages, even though their mobile devices had signal, apps responded, and emails arrived. This combination—everything appears functional, but nothing loads—was the first clue that the issue lay not in the access network, but in the system translating domain names. The operator's DNS became the primary suspect, leading to an uncomfortable question: who truly safeguards critical infrastructure?

Why did Orange stop working if there was coverage?

The most common explanation points to the name server. With DNS down, devices establish connections but cannot find destinations: users can open apps, update systems, or make calls, but cannot browse websites. Several affected users described exactly this scenario, with one notable exception: specific pages continued to load.

From this emerged the workaround mentioned in discussions: switching to a third-party DNS, such as Google's, allowed browsing even while the operator's DNS remained down. However, this only works if users know how to adjust router or device settings. Most do not, and they are the majority paying the bills.

RIPE, BGP, and the lack of two-factor verification

Reports suggest the origin lies with the RIPE account, the European registry managing IP addresses. According to these accounts, the attack involved brute force methods, and the compromised account lacked two-factor authentication. Access to this panel allows changes to address range assignments, impacting routing. Some went further, describing poisoning attacks on the BGP protocol, which operators use to announce network paths.

Discussions quickly turned to the cost of securing such systems. Hosting internal DNS within a DMZ, including maintenance and backups, was estimated at between 500,000 and 1,000,000 for an IBEX-listed company. It was also noted that six servers from a major CDN network were reportedly compromised months earlier. A previous incident—the 2022 hack of Spain's tax agency (Hacienda) affecting half a million taxpayers—was cited to highlight that this pattern is not new.

From medical appointments to ATMs: the cost of total digital reliance

Here, the issue ceases to be merely technical. In the 1980s, without internet, phone calls still worked. With networks down, there are no calls, credit card transactions, alarms, or pre-booked appointments, even when visiting health centers. Physical cash remains usable; ATMs do not.

A logistics operator provided a stark example: their company, an Orange client, maintained access to the master website and branches operated normally, yet other services were unreachable. With 40,000 shipments per hour, losing access for an afternoon translates into unaccountable financial losses.

Who fixes this and how long does it take?

For RIPE, restoration was swift, occurring in a fraction of the usual time. An individual losing credentials typically waits 48 hours; under similar logic, an SME would face a week of downtime.

Another source of frustration is customer support, often outsourced and shared across brands using the same underlying network. Regardless of the label, coverage relies on inherited infrastructure, and blame consistently falls on the same entity.

A public network sold with French accents

The historical context discussed is significant: today's Orange network was originally Amena, previously Retevisión, a state-owned entity. Building it cost nearly 38,000 million pesetas, eventually passing to France Telecom, then to funds like BlackRock. The French state retains 10% ownership; Spain has no say.

If reports are accurate—a corporate registry account protected only by password and lacking two-factor authentication—the question is not how attackers entered, but how many operators remain equally vulnerable.