SFR Customer Data Listing Claims 15,818 Records With Contact and Banking Fields
Overview
A poster using the handle "Syrv4x" claims to be sharing an SFR dataset. The post describes SFR as the second-largest telecommunications and mobile network operator in France, providing fixed, mobile, internet and television services.
The listing advertises 15,818 records in a 13 MB file. The visible field list includes names, addresses, email addresses, phone numbers, order information, appointment details, account-status fields, comments and fields labeled bank and rib. One JSON-style sample is shown, while the download is hidden until a forum reply is posted. The dataset, its source, the claimed volume and the contents of the full file have not been independently verified.
Post details
What the post claims
- 15,818 records advertised
- 13 MB file advertised
- Dataset offered for free
- Download hidden until a reply is posted
- First-name and last-name fields listed
- Address, postal-code and city fields listed
- Email and fax fields listed
- Home, work and mobile phone fields listed
- Order ID and account-related fields listed
- Appointment and technician-appointment fields listed
- Fields labeled bank and rib listed
- One JSON-style sample displayed
- Multiple comment and status fields listed
- No acquisition method stated
The visible sample demonstrates that the listing contains structured customer and order-related fields, but it does not establish the full file’s existence, its source or whether all advertised fields are populated across the dataset. Personal details shown in the sample are not transcribed here.
Screenshots
IOCs & contact identifiers
Identifiers visible in the listing. These support correlation and do not independently establish unauthorized access.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | Syrv4x | Screenshot 1 |
| Named organization domain | sfr[.]fr | Screenshot 1 |
The domain identifies the organization named in the claim, not malicious infrastructure. No Tox ID, Session ID, malware hash or attacker-controlled IP address is visible. Customer identifiers shown in the purported evidence are not included in this table. The destination of the hidden download is not visible. URLs to any data will always be blurred out, but are available for subscribers on the threat feed or ransomware feed.
Mapped techniques
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
- Collection T1213.006 Data from Information Repositories: Databases Inferred The post describes the material as a database and shows structured customer, order and account-related fields. It does not disclose the collection method or establish unauthorized access to SFR systems.
Potential impact
If authentic, the claimed dataset could expose names, addresses, email addresses, phone numbers and order-related information, creating opportunities for targeted phishing, impersonation and other account-focused social engineering. Fields labeled bank and rib are also listed, although the screenshot does not establish how broadly those fields are populated.
Status Unverified
Dark Web Informer has not independently verified the dataset’s authenticity, source, 13 MB size, 15,818-record count or current availability. The screenshot shows one sample rather than the full file. The download is concealed behind a reply requirement, and no response from SFR appears in the supplied material.
