Saudi Arabia
Logistics / Courier
Data for Sale
SMSA Express Allegedly Breached, 124.7 Million Shipment Records With Sender and Recipient Details for Sale
A seller posting as Demetrius is advertising what they describe as a corporate dataset from SMSA Express, one of Saudi Arabia's largest courier and logistics operators. The listing claims 261GB comprising 124,734,059 shipment lines, stating that each line carries two sets of personal details, one for the sender and one for the recipient. The advertised schema covers names, phone numbers, street addresses, and cities for both parties, along with tracking barcodes, package status and scan data, weight and piece counts, declared value and currency, and a description of each shipment's contents. The seller offers it as a one-time sale via escrow at a negotiable price. The claim is unverified.
Saudi Arabia▣Post details
Saudi Arabia!Allegedly included
- Sender names
- Recipient names
- Sender addresses
- Recipient addresses
- Sender & recipient cities
- Contact phone numbers
- Secondary phone numbers
- Tracking barcodes
- Commodity descriptions
- Declared value
- Declared currency
- Package weight & pieces
- Package status
- Scan & handling data
- Account owner reference
◱Screenshot
⚠Potential impact
The headline figure needs qualifying: 124.7 million lines are shipments, not people. Customers appear once per parcel, so the number of distinct individuals will be very substantially lower, though against a national population of roughly 35 million a dataset of this depth would still imply broad coverage over the years it spans. Scale aside, the field that carries the most weight is the commodity description. A courier record does not merely place a named person at a street address with a working phone number; paired with a description of contents and a declared value, it reveals what that person ordered and what it was worth. Applied across years of shipments, that is a behavioural profile covering purchases people may have had specific reasons to keep private, including medical supplies and personal items, and in this jurisdiction the sensitivity of certain categories is higher than the raw fields suggest. The sender-recipient pairing compounds it, since the data maps who corresponds with whom, exposing both personal relationships and commercial supply relationships between businesses. The most probable near-term harm is more mundane but affects the largest number of people: parcel delivery fraud is already among the highest-volume scam categories globally, and an attacker holding a genuine tracking barcode, the recipient's real name and address, and an accurate description of an actual shipment can produce a message that is effectively indistinguishable from a legitimate one. High declared values also identify which addresses received valuable goods, which has physical implications. The claim is unverified.
iStatus
UnverifiedThe listing is a one-time sale routed through escrow with no fixed price and an encrypted messenger contact, which Dark Web Informer is not reproducing. No sample records were published, so the field list is the only evidence offered, and the schema names given are consistent with an operational courier tracking system rather than a marketing export. The seller account has been active on the forum for around ten months with a modest posting history and elevated rank. Neither the line count nor the archive has been independently corroborated. The claim is unverified and SMSA Express has not publicly addressed it. Customers of the service may wish to treat delivery notifications citing tracking numbers with particular caution, including those that appear to reference genuine past shipments.
DARK WEB INFORMER - THREAT INTELLIGENCE
