Real-time anomaly detection in urban areas from massive data is a recent research field with challenging requirements. This paper presents a lightweight and robust framework for real-time anomaly detection in multivariate time-series extracted from large-scale Mobile-phone Network Data (MND). Our solution relies on unsupervised machine learning applied to MND collected at individual antennas of a nation-wide French mobile phone network operator. The proposed framework is based on a two-step approach: (i) the offline stage aims at assessing the typical behaviour of the antennas; (ii) the online stage performs real-time comparison of incoming data with respect to the detected typical behaviour. Results related to a real case-study of terrorist attack in the city of Lyon showcase that our framework can successfully detect an emergency event almost instantaneously and locate the anomalous area with high precision.