Two carriers on the invoice, one core on the network

Yesterday, in France, millions of Orange customers lost calls, texts and data; plenty of them were still looking at full bars on the screen. Fibre, meanwhile, kept working. If your sites' plan B is a router with a SIM in it, there is one thing worth checking today: how many of those SIMs register on the same network. Because if the answer is "all of them", you have one backup for the whole company and you are paying for it once per site.

What happened on 21 October

At around 11:20 CEST on Wednesday 21 October 2026, customers of Orange and its Sosh brand could no longer make calls, send texts or use mobile data anywhere in France. Outage tracker Downdetector went from roughly nine reports on a normal day to about 12,000 around midday, with reports from Paris, Lyon, Toulouse, Marseille, Lille, Bordeaux and Strasbourg. Orange has on the order of 21.6 million mobile customers in the country. Service was not fully restored until shortly after nine in the evening: nearly ten hours.

Two details of the damage pattern matter more than the headline. First: fibre held. Anyone with a fixed line at home or in the office stayed connected and could call over wi-fi. Second: 5G home internet boxes did go down. Which means the boundary of the outage was neither geographic nor commercial: it was which network each access used. And 112 remained reachable, but from a landline or from another operator's mobile.

On the cause, Orange attributed the incident to an equipment failure inside its mobile core network, without saying which. French media also picked up a theory, raised by a security researcher, that the outage was related to moving subscribers onto a new 5G core; Orange does not endorse it and neither do we. What does hold up without speculating is the shape of the failure: nationwide, simultaneous, ten hours long and confined to mobile. That is not a mast, a trench or a data centre. It is a logical component shared by the entire country. It was, incidentally, Orange's third nationwide outage of 2026, after those of 30 January — around seven and a half hours — and 29 June.

Route diversity does not cover this

A few months ago we wrote about why two links only count as two if they share no duct, no chamber and no cable: redundancy is not route diversity. All of that still stands, but it answers a different kind of failure. Route diversity answers the backhoe: something breaks in one place, so the remedy is to go through another place.

A mobile core is not in a place in that sense. It is the set of elements that authenticate your SIM and open its data session. When one of those elements stops answering, the fault has no geographic radius: it reaches every subscriber that depends on it, wherever they are. Two sites at opposite ends of the country, on fibres that share not a single metre of trench, share that element if their backup SIMs ride the same network. That is a correlated failure, and it is exactly what the backup design assumed could not happen.

Three ways to share a core without knowing it

The first is the obvious one and the least common: buying the primary access and the backup from the same operator because the price was better and the account manager was the same. You spot it by reading the invoice.

The second is the deceptive one. Your backup SIM carries another brand, another logo and another invoice, but that brand has no network: it rents one. Virtual operators are not all alike, and the difference is precisely the one that matters here. A full MVNO maintains its own switching and transmission infrastructure and leases the radio part from a host. A light MVNO provides the brand, the billing and the customer service, and leans on the host's core. And a reseller, in the industry's own definition, possesses no core elements at all. Day to day, all three sell identical gigabytes. In a core outage, the first is a different operator and the third is the same operator under another name. No price page on any website tells you which of the three you bought.

The third starts before you choose the backup: the primary was misfiled in the inventory. It is the small site whose "internet" is really a 5G fixed wireless access box. It appears as the branch's data line, and the backup placed next to it is a SIM. Those are two mobile accesses. On 21 October, those boxes went down and the fibres did not.

The ten-minute check: read the PLMN

You do not need to take the salesperson's word for it, or interpret the logo on the SIM. Each router's modem knows which network it is registered on and states it as a number: the PLMN, the country code (MCC) stuck to the network code (MNC). On a MikroTik — we use them daily — you read it with /interface/lte/monitor, in the current-operator field, and out comes a number such as 21403: the first three digits are Spain, the rest is the network. If the router is not a MikroTik, the universal command is the old AT+COPS? against the modem, which returns the same code when asked for in numeric format. In Spain the PLMN has five digits because the MNC has two; in other countries it can have three and you will see six.

The network codes registered in Spain are public: the registry lists close to forty, most of them virtual brands. The ones you will actually see broadcast by a radio network are these:

Look at the two codes flagged as resale: the registry associates them with brands that are not the host and that show up under its network. That is the clue. If the backup SIM at your Vigo site and the one at your Girona site return the same PLMN, they are on the same radio and — unless one of them is a full MVNO with its own core — on the same core too: count one backup, not two. The PLMN is the first filter, not the whole answer — it tells you which network you are registered on, not who authenticates you — which is why the second question in the list further down is still mandatory.

Spain has fewer cores than it looks

Here is the warning that turns the table above into something more than trivia. Orange and Yoigo are the same group today. MasOrange switched off Yoigo's radio network in 2025 and has commissioned Ericsson to build a single standalone 5G core for every brand in the group, as well as ending its network rental from Movistar. So 21403 and 21404 are not two cores: they are two labels on the same path. If your primary is one of the group's brands and your backup is another, the design you thought you had came apart without you changing anything.

And the symmetrical warning, because the PLMN does not settle the other side either: Digi has its own core — built with Nokia — but shares radio with Movistar under a RAN sharing agreement. A different code therefore does not guarantee a different radio. Between the two, the Spanish market has come to look more and more like a place with fewer independent cores than there are logos on the counter. Which is why you compare the PLMN and then also ask: the number gives you the access layer in thirty seconds, and the written question gives you the layer underneath.

That fills a four-column table that fits on one sheet: site · primary access (operator and medium) · backup (operator, medium and the PLMN you read, not the one on the packaging) · do they match?. We keep that information in NetBox alongside the rest of the network inventory, for the same reason we do not keep it in a spreadsheet: when a SIM changes, it has to change in the place somebody will actually look at three in the morning.

The failure your failover never sees

Suppose the backup really is on another network and it is the primary that loses its core. A second problem remains, and it is one of detection. In a core failure the modem can stay attached to the radio: full bars, cell identified, interface "up". What is missing is a usable session. Failover that decides on interface state does not fire. Failover that pings the operator's own gateway does not either, because that hop may keep answering.

The rule we apply is easy to state and constantly skipped: the probe has to end where the service ends, outside the network of the operator you are watching, and the decision has to be made on loss and latency, not on link state. If both your accesses are probed against a target that lives inside the primary operator's network, you are measuring the health of the thing that fails with a thermometer it manufactures itself. It is the same measurement argument we made in when SD-WAN pays off and when it does not, seen from the bad-day side.

Three questions worth putting in writing

• Which PLMN does this SIM register on? Not "whose network is it", but the number. If the answer is slow or evasive, read it off the modem yourself and be done.
• Is the service delivered on your own core or on the host's? That is the question separating a full virtual operator from a reseller, and the one that decides whether your backup survives an outage like 21 October's.
• How and how quickly do you notify me of a network incident, and what happens if it lasts ten hours? Finding out through a colleague's phone while yours is dead too is an expensive way to manage an incident.

When you do not need any of this

We say this with the conflict of interest up front: we are an operator with our own network and we sell connectivity and SD-WAN, so everything that follows argues against our own invoice. If you have a single office on fibre and the worst a mobile outage does is push people onto wi-fi calling, you do not have an architecture problem. If your mobile backup exists to carry email and a couple of web apps for two hours, it is correctly sized even if it is modest. And if the load you need to sustain is 200 megabits of steady traffic to an ERP, then the problem is not which network the SIM is on: a SIM is not the backup for that, and calling it one only helps you sleep until the day it does not work.

And one more piece of honesty, because it applies just as much if you hire us: buying both accesses from us also concentrates supplier risk. The correlation is removed by the design, not by the letterhead on the invoice: different media, different networks, different PLMN codes and a probe that depends on neither. If that holds with two suppliers, fine; if it holds with one, also fine. If it does not hold, it makes no difference how many logos are involved.

The part that is on us

When we design a multi-site SD-WAN, the PLMN column goes into the inventory from day one, and failover policies are tested by genuinely cutting the primary access, during office hours, with somebody watching. It sounds like ceremony until the first time the test finds out that failover was watching interface state, instead of a Wednesday at 11:20 finding out for you. On the networks and communications side, the criterion is the one we apply to our own network: you probe against points that do not live inside the thing you are probing.

If you want to fill in that four-column table with somebody who has filled it in before, it is a short conversation: get in touch. And if you would rather do it yourself, better still; if all you do is check your routers' PLMNs this afternoon, this article has already been worth something.

Five digits, and what they do not say

A backup that shares a core with the primary is billed twice and serves once. Today's question is not how many operators are on your invoice: it is how many different PLMNs are in your routers, and how many different cores sit behind those PLMNs. The first is five digits and one command, and you can have it this afternoon. The second is an email to your provider worth having answered in writing before you need it.

Sources. Details of the Orange incident of 21 October 2026 — start around 11:20 CEST, impact on Orange and Sosh calls, texts and mobile data, 5G home internet boxes down while fibre lines largely stayed up, around 12,000 Downdetector reports around midday against roughly nine on a normal day, cities affected, restoration shortly after 21:00, 112 reachable from a landline or another operator's mobile, the figure of some 21.6 million Orange mobile customers in France, Orange's attribution to an equipment failure in its mobile core without specifying which, the unconfirmed theory about a move to a new 5G core, and the reference to the earlier nationwide outages of 30 January (around seven and a half hours) and 29 June 2026 — come from The Next Web, Sortiraparis and France 3 / franceinfo coverage published on those days; the 5G core theory was raised by a security researcher and picked up by the French press (Numerama, Journal du Geek), without Orange endorsing it. That enabling wi-fi calling over the fixed line restored calls and texts was reported by Planet. The Spanish MCC/MNC codes (214-01 Vodafone, 214-03 Orange, 214-04 Yoigo/Xfera Móviles, 214-05 and 214-07 Movistar/Telefónica, 214-06 Vodafone, with 214-05 and 214-06 identified as codes used for resale) come from the public network-code registry mcc-mnc.org, which lists close to forty entries for Spain, among them 214-09 (Orange) and 214-22 (Digi, Best Spain Telecom). That Orange and Yoigo now belong to the MasOrange group, that it switched off Yoigo's radio network in 2025, that it has commissioned Ericsson to build a single standalone 5G core for all its brands and that it is ending its network rental from Movistar comes from Xataka Móvil, BandaAncha and La Ecuación Digital. That Digi has its own core built with Nokia and deploys its radio through a RAN sharing agreement with Movistar comes from Mobile World Live, Redes&Telecom and ADSLZone. Reading the PLMN on RouterOS through /interface/lte/monitor and the current-operator field as the concatenation of MCC and MNC comes from MikroTik documentation. The distinction between full MVNO, light MVNO and reseller — in particular that a reseller possesses no core elements — comes from the description of MVNO types on Wikipedia. Framing a core failure as a logical dependency shared across sites, the four-column inventory table, the three questions for the provider and the rule of probing outside the operator being watched are our own judgement and method, not claims made by any of the sources above. everyWAN is an operator with its own network and sells connectivity and SD-WAN: the conflict of interest is declared. Cover photo: "5G Small Cell Antennas on Pittsburgh Rooftop", Tony Webster, Wikimedia Commons, CC BY 2.0.