France
Telecommunications
Customer & Billing Data
Leak Claim
Unverified
Geofixe Data Leak Claim Lists 1,656 Records With Customer, Billing and Payment Information
Overview
An actor using the handle "ChimeraZ" claims to have leaked a database associated with Geofixe, a French telecommunications service that provides virtual landline numbers.
The listing advertises 1,656 lines in a 328 MB CSV dataset, with 130 email addresses and 56 phone numbers. The visible files include cards.csv, charges.csv, invoices.csv and people.csv, with samples showing customer names, email addresses, phone numbers, billing addresses, card-related fields, charge records and invoice/payment data. The dataset, its source, the stated counts and current availability have not been independently verified.
Post details
FranceWhat the post claims
- 1,656 total lines
- 130 email addresses
- 56 phone numbers
- 328 MB dataset size
- CSV format
- cards.csv referenced
- charges.csv referenced
- invoices.csv referenced
- people.csv referenced
- Customer names included
- Email addresses included
- Phone numbers included
- Billing / postal addresses included
- Card-related fields included
- Charge and payment records included
- Invoice records included
- Multiple download mirrors provided
The visible samples contain direct customer identity, contact, billing and payment information. Those individual values, invoice URLs, card-related values and payment references are not transcribed in this report.
Screenshots
IOCs & identifiers
Identifiers directly visible or supported by the supplied material. These support correlation and do not independently verify the dataset claim.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | ChimeraZ | Screenshot 1 |
| Telegram | @chimeradbs | Screenshot 1 |
| XMPP | chimeraz@xmpp.is | Screenshot 1 |
| Named organization domain | geofixe[.]com | Screenshot 1 |
The organization domain identifies the entity named in the claim, not malicious infrastructure. No malware hash, Tox ID, Session ID or attacker-controlled IP address is visible in the supplied screenshot. Customer identifiers, payment links and direct download mirrors shown in the source material are intentionally not reproduced here.
Mapped techniques
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
- Collection T1213.006 Data from Information Repositories: Databases Inferred The listing presents structured CSV datasets containing people, card, charge and invoice information. The supplied material does not disclose how the data was obtained or independently establish unauthorized access to Geofixe systems.
Potential impact
If authentic, the claimed dataset could expose customer names, email addresses, phone numbers, postal addresses, billing records, card-related information and invoice/payment metadata. That combination could support targeted phishing, identity fraud, payment fraud, impersonation or other customer-focused abuse.
Status Unverified
Dark Web Informer has not independently verified the dataset's authenticity, source, completeness, 1,656-line count, email or phone totals, 328 MB size, sample contents or current availability. The supplied screenshot documents the listing and visible samples, not independent confirmation of the underlying data.
