> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# More Than a Million Salt Mobile Records Offered for Sale
- URL: https://darkwebinformer.com/more-than-a-million-salt-mobile-records-offered-for-sale/
- Published: 2026-09-03T15:31:34.000Z
- Updated: 2026-09-03T15:31:34.000Z
- Author: Dark Web Informer
- Tags: Cybercrime

Breach Report Switzerland Telecoms Price By Offer 

## More Than a Million Salt Mobile Records Offered for Sale

A forum actor posting as **SaltMobile1** is selling what they describe as a database of **Salt**, a Swiss mobile operator, containing **more than 1,090,000 records**. The stated fields are **record identifier, name, date of birth, street and house number, postal code, city, country, a complete address string, email address, up to three telephone numbers, a count of numbers held and a timestamp**. The actor's own word for how it was obtained is **scraped** rather than breached, and no mechanism is described. The post also carries a warning that **another party is reselling the same samples**. Price is by negotiation. The claim is **unverified**.

Severity HIGH 

[ ![WhiteIntel, dark web exposure monitoring](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) 

Records1,090,000+

Extraction datedJan 2026

Method claimedScraping

ActorSaltMobile1

### ▣Post details

TargetSalt

CountrySwitzerland

SectorMobile telecoms

ListingSelling, price by offer

Volume1,090,000+ records

Stated sourceScraping

ObservedSep 2, 2026

ActorSaltMobile1

### !What the post claims

- More than 1,090,000 records
- Described as scraped
- Record identifiers
- Full names
- Dates of birth
- Street and house number
- Postal code and city
- Country field
- Complete address string
- Email addresses
- Up to three phone numbers
- Count of numbers per record
- Extraction timestamps
- Sample published inline
- Price by negotiation
- Warning about a rival seller
- Offer of further samples
- No mechanism described

### ◱Screenshot

[ ![Forum listing selling an alleged Salt Mobile database of over one million Swiss records, September 2026](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/62378523978659287635987623598762938765.png) Screenshot 1 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/62378523978659287635987623598762938765.png) 

Forum post offering Salt Mobile records for sale, observed 2 September 2026.

### ☷Mapped techniques

Mapped from the actor's own account. Claimed, not confirmed.

- Initial access [T1190](https://attack.mitre.org/techniques/T1190/) Exploit public facing application Inferred Collection at this volume through scraping implies an interface returning full customer records to an unauthenticated or weakly limited caller. No endpoint is named.
- Collection [T1213](https://attack.mitre.org/techniques/T1213/) Data from information repositories Inferred Every sample row carries a timestamp within the same second, differing only in fractions, which indicates one automated run rather than records created over time.
- Exfiltration [T1567](https://attack.mitre.org/techniques/T1567/) Exfiltration over web service Inferred Samples are posted inline and the sale is handled through messaging services.

### ⚠Potential impact

For a mobile operator's customers the sharp risk is **account recovery and SIM swap**, because name, date of birth and address are the details support desks still use to confirm identity, and here they arrive **already attached to the subscriber's own numbers**. Records holding two or three numbers also expose **household or family groupings**, which makes a call claiming to be about a relative's line considerably more convincing. Dates of birth are the element that lifts this above an ordinary marketing list, since they are reused as a verification factor well beyond telecoms.

### iStatus Unverified

The **timestamps are the most informative detail in the post**: across the sample they fall within a single second in January 2026, differing only in fractions, which is the signature of one scripted collection run rather than data accumulated by a business over years. The actor also says **scraped rather than breached**, which points at an interface returning more than it should rather than an intrusion, and the field mixture sits oddly, since address and multiple phone numbers resemble directory data while dates of birth and email addresses do not. **Provenance is contested**, with the post itself alleging another seller is circulating the same samples. Dark Web Informer has **not retrieved the data and is not linking the contact addresses**, and Salt has not publicly addressed the claim.

Want everything on this breach? **Paid subscribers** get the full unredacted claim details and more. After subscribing, check out the [threat feed](https://darkwebinformer.com/threat-feed/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=salt-mobile-2026-09-02&utm%5Fcontent=threat-feed) and search there for this alert.

[View pricing →](https://darkwebinformer.com/pricing?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=salt-mobile-2026-09-02&utm%5Fcontent=pricing-button) 

[Dark Web Informer](https://darkwebinformer.com/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=salt-mobile-2026-09-02&utm%5Fcontent=footer) // Threat Intelligence