Antena Sur Comunicaciones · Breach

[Single source] Claim: Actor sells 892,000 records from Argentine telecom dealer Antena Sur

Nov 09, 2026 · 1 min read

A threat actor is selling about 892,000 records from Antena Sur Comunicaciones for $4,700 on a dark web forum. Samples include customer names, emails, phone numbers and addresses, plus number portability requests with the current carrier. As the sale is only a claim, customers should watch for suspicious contacts and phishing attempts.

By HIFY Radar newsroom Updated 11/09/2026 09:41 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Observed

A dark web seller is offering about 892,000 customer records for $4,700, claiming the data was taken from Antena Sur Comunicaciones, a mobile phone and internet dealer based in Rosario, Argentina. The listing includes sample data and was surfaced by DailyDarkWeb, an account that monitors underground forums. The seller's claim of a breach has not been confirmed, and the company has said nothing publicly so far.

What happened

Observed

DailyDarkWeb reported that a threat actor posted the listing on a dark web forum. According to the report, Antena Sur Comunicaciones is a Rosario-based dealer for mobile and broadband services, with branches across the Santa Fe and Córdoba provinces.

Alleged

The seller claims to have obtained admin access to the dealer's online store, meaning full control over the systems that run it. That access is presented as the way in, but it is the actor's own account of events and nothing more. The post includes samples that appear to back the scale of the offer, though samples alone do not prove where the data came from.

Why it matters

Inferred

The most sensitive part of the advertised haul is the number portability data. Those records reportedly pair a phone number with a national ID document number and the current carrier. As DailyDarkWeb's analyst note points out, that exact combination is ideal for SIM-swap and port-out fraud, attacks where someone moves your phone number to a device or carrier they control and then intercepts your calls and verification codes.

What to do

Inferred

If you are an Antena Sur customer, the practical move is to assume scammers could have your details and to stay alert. Watch for odd calls, texts or emails that reference your purchase history or ID number, since attackers with this kind of data can make phishing, meaning fake messages designed to steal information, sound convincing. Ask your carrier to alert you before any number transfer, and treat any sudden loss of mobile signal as a reason to check for an unauthorized port-out immediately.

Confirmed and still uncertain

Observed

What is established so far is narrow: the forum listing exists, it asks $4,700, and it displays samples of the data on offer. DailyDarkWeb itself flags the claim as unverified and states plainly that it is not confirmation of a breach.

Observed

Plenty remains open. Nobody has verified that the data is genuine or that it actually came from Antena Sur, the claimed admin access is untested, and as of the reporting there was no statement from the company. Whether customers were affected in practice is unknown.

What people are saying

Observed

The only voice on the record right now is DailyDarkWeb, which paired its report with an explicit caution: unverified threat-actor claim, not confirmation of a breach. The seller, for their part, talks up admin access and a large dataset. The company has not responded publicly, so the conversation so far is the actor's sales pitch weighed against an analyst's warning.

Evolution

Observed

The public picture of this story currently rests on a single monitoring post. There is no follow-up reporting, no company statement as of that post, and no independent verification of the actor's claims. The narrative could shift quickly if Antena Sur confirms, denies, or if the data shows up elsewhere.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Observed

According to the post and its samples, the dataset spans several categories: customer names, emails, phone numbers and addresses; number portability requests that include the current carrier and national ID document numbers; and device purchase orders with payment status and shipping details.

Alleged

The actor claims the entry point was admin access to the dealer's online store. That would be consistent with an operation against the e-commerce platform rather than core carrier systems, since a dealer's store handles orders and customer accounts rather than the mobile network itself. This access claim remains unverified.

Sources and evidence

Observed

This story currently hangs on one source: a post by DailyDarkWeb on X, which includes an image of the listing and a summary of the samples. That source is careful with its own language, labeling the breach claim unverified and noting the absence of any company statement. Independent confirmation, forensic detail, or a response from Antena Sur would materially change the evidence base, and none exists in the current record.