Movistar Espanha Base alegada de clientes… · Breach

[Single source] Claim: Actor offers 347,000 Movistar Spain customer records for sale

Nov 09, 2026 · 1 min read

An actor is selling about 347,000 records of Movistar Spain residential and business customers on a dark web forum for $4,550. According to the seller, access came from an admin account on a KYC portal registered to a Movistar sales partner, not from Movistar's own systems. The data allegedly includes names, emails and phone numbers.

By HIFY Radar newsroom Updated 11/09/2026 01:37 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

A threat actor on a dark web forum is offering roughly 347,000 records they claim relate to Movistar Spain residential and business customers, with an asking price of $4,550.

Alleged

The seller claims the access came from an admin account on an identity-verification (KYC) portal tenant registered to a Movistar sales partner, not from Movistar's own systems. This is an unverified threat-actor claim, not confirmation of a breach.

What happened

Alleged

According to a DailyDarkWeb post on X, a threat actor listed the dataset for sale on a dark web forum, saying the records include names, emails, phone numbers and postal addresses, Spanish tax ID numbers (NIF), service and fiber installation orders including portability requests, and ID verification results with document type and reviewer decisions.

Alleged

The seller attributes the access to an administrator account on a KYC portal tenant belonging to a Movistar sales partner. No statement from Telefónica had been reported at the time of the post.

Why it matters

Inferred

If authentic, the dataset would give attackers names, contact details, national tax IDs and real order information: a combination well suited to convincing impersonation of Movistar in calls and SMS that quote genuine order details.

Inferred

The alleged vector underscores third-party risk: rather than a direct compromise of Movistar, a reseller's verification account would have provided a window into customer onboarding across the operator's sales channel.

What to do

Inferred

Movistar customers in Spain should be extra wary of unsolicited calls or SMS that reference real order details, installation appointments or their NIF, since such details could be quoted convincingly if the data is genuine.

Inferred

Security teams should treat this as an unconfirmed claim for now and monitor for an official statement from Telefónica or Movistar before drawing conclusions about scope or impact.

Confirmed and still uncertain

Observed

Known: a dark web listing offering about 347,000 Movistar-related records for $4,550, with a specific field list and a claimed access path through a partner's KYC portal, as reported by DailyDarkWeb on X.

Inferred

Unknown: whether the data is genuine, how many current Movistar customers are actually affected, whether the partner tenant was truly compromised, and whether Telefónica has investigated or will comment. The original forum post has not been independently verified.

What people are saying

Observed

DailyDarkWeb, the account that surfaced the listing, cautions in an analyst note that this is an unverified threat-actor claim and not confirmation of a breach, and that if real it would represent a third-party exposure through a reseller's verification account.

Observed

The same account notes that no statement from Telefónica had been issued so far, and warns customers to expect convincing 'Movistar' calls and SMS quoting real order details.

Evolution

Observed

The available evidence covers a single point in time: the original forum listing as reported on X. As of this report there is no follow-up on takedown, buyer activity, sample validation, or any carrier response in the provided material.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The claimed access path is an admin account on an identity-verification (KYC) portal tenant registered to a Movistar sales partner, distinct from Movistar's own infrastructure.

Alleged

The advertised fields go beyond basic contact data: Spanish NIF tax identifiers, service and fiber installation orders including portability requests, and KYC artifacts such as ID verification results, document type and reviewer decisions.

Sources and evidence

Observed

This item rests on a single source: a DailyDarkWeb post on X describing a dark web forum listing. The underlying forum post, data samples and seller identity have not been independently verified, and no corroboration from Telefónica, the named partner, or other researchers is present in the evidence batch.