Galang Taruna
Orange, one of France’s leading telecommunications providers, has officially attributed the massive national network outage that occurred on Wednesday, October 21, 2026, to a critical software bug within a Nokia-supplied component of its new 5G standalone (SA) core network. This revelation, disclosed by Jérôme Hénique, CEO of Orange France, in an interview with Le Figaro on Friday, October 23, 2026, contradicts earlier speculations about a failed migration to 5G and underscores a significant failure in the network’s redundancy mechanisms. The incident left millions of customers across France without mobile calls, SMS, or data services for several hours, exposing vulnerabilities in modern telecommunications infrastructure.
The October 21st Blackout: A Detailed Chronology
The disruption began to manifest with initial customer reports surfacing around 11:20 AM on October 21, 2026. Orange officially pinpointed the start of the incident to 11:37 AM. Within minutes, a significant portion of Orange’s mobile network infrastructure, including its critically important core network, began experiencing severe degradation. The problem quickly escalated, affecting mobile services for Orange and its low-cost subsidiary, Sosh, across the entire national territory. Customers reported an inability to make or receive calls, send text messages, or access mobile internet, triggering widespread concern and frustration.
Orange initially remained discreet about the precise causes of the outage, confirming only that its core network was impacted. This silence fueled speculation, with some reports, notably from Numerama, suggesting a failed transition of subscribers to the new 5G SA core network. However, two days later, Jérôme Hénique provided Orange’s definitive explanation. He revealed that the root cause was a software bug embedded within a Nokia-supplied component of the new mobile core network. This specific flaw caused network equipment to crash repeatedly upon receiving certain error messages, creating a cascading failure. Compounding the problem, every attempt to restart the affected equipment resulted in immediate subsequent crashes.
Nokia engineers, working in conjunction with Orange teams, managed to identify the elusive bug around 5:00 PM. Following this crucial identification, efforts to restore service commenced. The network progressively returned online between 6:30 PM and 8:30 PM, gradually alleviating the widespread disruption. The incident, spanning approximately seven to nine hours from the first reports to full restoration, affected millions of Orange and Sosh customers, marking one of the most significant service disruptions in recent French telecommunications history.
Understanding the Core Network: The Brain of Mobile Communications
To grasp the gravity of the October 21st outage, it is essential to understand the function of a core network. Often referred to as the "brain" of a mobile network, the core network is a complex, centralized part of the telecommunications system that provides a range of services to customers. For Orange, managing 22.65 million mobile lines in France as of late June 2026, its core network is an immense and intricate system distributed across multiple technical centers nationwide.
The core network performs several indispensable functions:
- Subscriber Authentication: It verifies the identity of every SIM card attempting to connect to the network, ensuring only legitimate users can access services.
- Call Routing: It directs voice calls between mobile users, and between mobile users and fixed-line networks.
- SMS Delivery: It handles the transmission and reception of text messages.
- Data Management: It manages mobile internet traffic, ensuring data packets are routed efficiently to and from users’ devices.
- Mobility Management: It tracks the location of mobile devices to ensure calls and data can be delivered to them regardless of their physical location.
A failure in this central nervous system of the network inevitably leads to widespread service disruption, as evidenced by the October 21st incident. The transition to a new 5G SA core network, such as the one being deployed by Orange with Nokia’s assistance, represents a significant technological leap. 5G SA promises lower latency, higher bandwidth, and greater capacity, but also introduces new complexities and potential points of failure if not meticulously implemented and tested.
Nokia’s Role and the Software Anomaly
Orange’s decision in 2022 to select Nokia as a primary vendor for its 5G SA core network in France highlights the critical reliance on technology partners for foundational infrastructure. Nokia, a global leader in telecommunications equipment, was tasked with providing the crucial components that would underpin Orange’s next-generation mobile services. The software bug, therefore, represents a significant challenge for both Orange and Nokia.
According to Jérôme Hénique, the specific software flaw was located in a Nokia-supplied equipment component responsible for authenticating SIM cards and routing mobile traffic (calls, SMS, data). The bug was triggered by certain error messages, causing the equipment to become unstable and crash. This type of vulnerability, where specific data inputs can lead to system failure, is a known challenge in complex software development. The repeated nature of the crashes, where restarts failed to resolve the issue because the underlying software flaw persisted, created a difficult and prolonged recovery scenario for Orange’s technical teams. The incident underscores the intricate relationship between hardware and software in modern telecommunications and the profound impact a single, yet critical, software bug can have on national infrastructure.
Debunking Initial Theories: Migration, Cyberattack, and Updates
The immediate aftermath of a widespread outage often leads to various theories attempting to explain the cause. On the evening of October 21, 2026, media outlets like Numerama speculated that the outage stemmed from a botched migration of subscribers to Orange’s new 5G SA core network. This theory posited that an unsuccessful transition might have overloaded or destabilized the new infrastructure, leading to the nationwide disruption.
However, Orange definitively rejected this hypothesis. Jérôme Hénique clarified that the migration process to the new 5G SA core network had been ongoing for eighteen months, conducted in carefully managed batches of approximately 100,000 customers at a time, without any particular difficulties. Orange also explicitly ruled out a cyberattack or a defective software update as potential causes.
Despite Orange’s rejection, the initial theory of a migration issue and the official explanation are not entirely disparate. The bug, Orange confirmed, affected the new core network. Critically, only subscribers already migrated and therefore attached to this new infrastructure were impacted. Customers still operating on the older core network were unaffected. This detail suggests that while the migration itself was not "botched" in the sense of a failed procedure, the vulnerability existed within the newly deployed components. Given that the migration had been underway for 18 months, it is reasonable to infer that a substantial portion of Orange’s subscriber base had already transitioned to the new core network, explaining the extensive reach of the outage even among 4G subscribers, as the new core supports both 4G and 5G SA traffic. Orange further confirmed that 3G services, emergency calls, and fiber optic internet connections remained operational, indicating the specific nature of the fault within the mobile core network rather than a broader infrastructure collapse.
The Critical Failure of Redundancy: A Systemic Challenge
Perhaps the most concerning aspect of the October 21st incident for Orange was the failure of its redundancy systems. Network redundancy is a fundamental principle in telecommunications design, involving the duplication of critical equipment and systems across multiple, geographically dispersed sites. This architecture is designed to ensure continuous service even if one component or site experiences a hardware failure, power outage, or even a natural disaster like a fire. The backup systems are intended to automatically take over, minimizing downtime and maintaining service continuity.
However, in this particular incident, the robust redundancy mechanisms proved ineffective. Jérôme Hénique candidly acknowledged that the software bug was present identically on all machines, including those designated as backups and installed on different physical sites. This meant that when the primary equipment crashed due to the bug, the redundant systems, afflicted by the very same software flaw, also failed when attempting to take over. This "common mode failure" is a nightmare scenario for network architects, as it bypasses the inherent protection offered by redundancy.
Hénique described the incident as "extraordinary" precisely because the redundancy failed to function as intended, and because of the extended time it took to identify the underlying software bug. This admission highlights a critical vulnerability: while physical redundancy protects against hardware failures, it offers no safeguard against systemic software flaws that are replicated across all deployed instances of a particular component. Orange has stated it is conducting a thorough investigation with Nokia to review its security and recovery mechanisms, aiming to prevent similar incidents in the future. This probe will likely focus on enhancing software testing protocols, particularly for vendor-supplied components, and exploring more diverse redundancy strategies that account for common mode software failures.
Impact on Customers and Orange’s Compensation Response
The national outage had a significant impact on millions of Orange and Sosh customers, disrupting personal communications, business operations, and access to essential online services. While Jérôme Hénique did not provide an exact figure, he referred to "several million clients" being affected. He also drew a comparison to a previous major outage in July 2012, stating that the October 21st incident, though serious, lasted a shorter duration and affected fewer customers than the 2012 event.
The July 6-7, 2012, outage, also caused by a software flaw in a central mobile network component, had deprived approximately 27 million Orange users of network access for about twelve hours. In response to that incident, Orange had offered its mobile subscribers a full day of unlimited calls, SMS, and internet usage as compensation.
For the October 2026 outage, Orange’s initial compensation package was met with mixed reactions. The operator announced it would double customers’ mobile data allowance for one month. Additionally, while ruling out any other general compensation measures, Orange did confirm that its customer service department would grant rebates of up to 10 euros for subscribers who specifically requested them. This approach, perceived by some as less generous than the 2012 offer, led to discussions among customers about the adequacy of the compensation relative to the disruption experienced. The contrast in compensation strategies between the two major outages highlights Orange’s evolving approach to managing customer relations in the wake of service disruptions.
Broader Implications and Future Outlook
The October 21st national outage carries significant implications beyond the immediate service disruption, affecting Orange’s reputation, regulatory scrutiny, and the broader telecommunications industry.
Economic and Social Impact: While difficult to quantify precisely, an outage of this magnitude can have considerable economic consequences. Businesses reliant on mobile connectivity for point-of-sale systems, logistics, or remote work experienced disruptions. Individuals faced difficulties in communication, accessing essential services, and participating in the digital economy. The incident underscored the pervasive dependence of modern society on robust telecommunications infrastructure.
Reputational Damage: For Orange, a company that prides itself on network quality and reliability, the outage represents a significant blow to its brand image. The failure of redundancy, in particular, raises questions about the resilience of its next-generation network architecture. For Nokia, as the supplier of the faulty component, the incident could prompt increased scrutiny from other telecommunications operators globally, potentially affecting future contracts and partnerships.
Regulatory Scrutiny: France’s telecommunications regulator, ARCEP (Autorité de régulation des communications électroniques, des postes et de la distribution de la presse), will undoubtedly take a keen interest in the findings of Orange’s internal investigation. Regulators typically demand transparency and accountability from operators following major service disruptions, often requiring detailed explanations and corrective action plans. This incident could lead to calls for enhanced regulatory oversight on network resilience and vendor selection processes, particularly concerning critical core network components.
Network Resilience and Testing Protocols: The outage serves as a stark reminder of the complexities inherent in deploying and managing advanced network technologies like 5G SA. It highlights the critical need for rigorous and comprehensive testing protocols, especially for new software deployments and vendor-supplied equipment. The fact that a software bug could bypass redundancy mechanisms suggests a potential gap in testing scenarios that simulate common mode failures. Operators and vendors will likely re-evaluate their quality assurance processes to prevent similar systemic vulnerabilities.
Vendor Diversity and Supply Chain Risks: While Nokia is a reputable vendor, reliance on a single supplier for critical core network components can introduce concentrated risks. The incident might prompt Orange and other operators to consider greater vendor diversity for their core networks, mitigating the risk of a single software flaw or hardware defect affecting the entire infrastructure. This ties into broader geopolitical discussions about supply chain resilience in critical infrastructure.
Trust in 5G Technology: As 5G SA networks are rolled out globally, incidents like this can impact public perception and trust in new technologies. While the bug was specific to a component and not an inherent flaw in 5G technology itself, any major outage can fuel skepticism about the reliability of next-generation networks. Operators must work to reassure the public through transparent communication and demonstrable improvements in network resilience.
In conclusion, Orange’s national outage on October 21, 2026, driven by a Nokia software bug in its new 5G core network, represents a pivotal event in French telecommunications. It exposed critical vulnerabilities in redundancy mechanisms and underscored the immense challenge of maintaining flawless operation in increasingly complex digital infrastructures. The comprehensive investigation and subsequent corrective actions by Orange and Nokia will be closely watched, shaping future strategies for network resilience, vendor management, and consumer confidence in the rapidly evolving world of telecommunications.
