The Luxembourg government has launched a formal investigation into a major nationwide telecom outage that occurred on July 23, following what officials say was a deliberate cyberattack. The disruption, which lasted over three hours, knocked out the country’s 4G and 5G mobile networks, severely hampering internet access, emergency service communications, and electronic banking.
Authorities revealed that the fallback 2G network was overwhelmed, leaving significant portions of the population unable to make emergency calls. “The attack was designed to be disruptive, not to compromise or infiltrate systems,” officials clarified in statements made to the national parliament.
The vulnerability was traced to a “standardised software component” utilized by POST Luxembourg—the state-owned telecom operator responsible for most of the country’s network infrastructure. Luxembourg’s national alert system also failed during the incident, as it relied on the same mobile infrastructure for communication.
POST’s Director-General characterized the cyberattack as “exceptionally advanced and sophisticated,” emphasizing that internal systems and user data were not breached. Both POST and the national Computer Security Incident Response Team (CSIRT) are currently conducting a thorough forensic analysis to determine the exact vector of attack.
Although the government has refrained from naming any specific vendors, local media outlet Paperjam reported that the breach may have involved software used in Huawei routers. The magazine also noted that Luxembourg’s critical infrastructure regulator is urging organizations using Huawei enterprise routers to contact CSIRT for assessment.
Historically, remote denial-of-service (DoS) vulnerabilities have been found in the VRP operating system powering Huawei’s enterprise networking gear, although no new public disclosures have been made recently. Huawei has not responded to media inquiries regarding the incident.
In response, the government assembled a crisis team within the High Commission for National Protection (HCPN), in coordination with CSIRT and the public prosecutor, to manage the fallout and assess the legal implications of the attack.
This incident has fast-tracked Luxembourg’s ongoing national resilience review. Authorities are now scrutinizing whether telecom fallback protocols are sufficiently robust and are considering regulatory reforms. Among the proposals: allowing mobile devices to switch automatically to other network providers during outages—a capability already active in the UK, Germany, and the US to ensure emergency call availability.
The outcome of the forensic investigation and the prosecutor’s review will determine whether criminal charges can be filed and if those responsible can be identified.