A threat actor claims to have breached Xacria XNO (Xacria Network Orchestrator), a carrier-grade, cloud-native network orchestration platform used by Tier 1, 2, and 3 telecommunications operators in Italy for zero-touch provisioning and automation of fiber broadband, mobile, and enterprise network services. The actor states the dump includes 446 service orders, full subscriber PII, mobile provisioning records, enterprise circuit data including router CLI commands, and hardcoded security tokens reused across all webhook integrations.

• 446 service orders spanning fiber broadband (FTTH/GPON), mobile broadband (MBB), and enterprise EVPN circuits for operators including FASTWEB and SKY ITALIA
• Subscriber PII including customer account numbers, IMSI identifiers, MSISDN phone numbers (Italian +39 prefix), MAC addresses, and assigned IP addresses
• Mobile subscriber provisioning records with prepaid charging profiles, 5G NSA/SA service status, data quotas, traffic shaping policies, and international roaming configuration
• Enterprise circuit data with VDSL access technology, QoS profiles, VLAN assignments, pseudowire IDs, and complete router CLI commands for Cisco IOS-XR, Huawei NE40E, Juniper MX960, and ZTE platforms
• Hardcoded security token (value redacted) reused across all webhook integrations to the XFlow workflow engine