Mokhaberat: Claim: 1877 group says it leaked…

CriticalBreachNo software to update

In 30 seconds

Alleged

The latest supplied update says a group called 1877 claims it obtained data on more than 19.6 million people from Iran's Telecommunication Company, also known as Mokhaberat. DailyDarkWeb explicitly labels the story an unverified threat-actor claim and says there was no official statement at the time of posting.

What happened

Alleged

According to both reports, 1877 says it compromised an employee account and then reached lists or services associated with backups, allowing it to extract subscriber, connection, identity and credential data. Neither report independently verifies that access or extraction.

Why it matters

Inferred

If the claimed dataset is authentic, the combination of identification numbers, personal details, credentials and subscriber records could enable fraud, SIM-swap attempts and targeted abuse. This is a conditional risk assessment, not evidence that those harms have occurred.

What to do

Inferred

For now, treat the report as an investigation lead rather than a confirmed breach. Relevant defenders should examine employee-account activity and backup-service access, validate any offered data samples, and invalidate credentials if exposure is established.

Confirmed and still uncertain

Observed

What is known is limited to two social-media reports relaying the same claim. The supplied evidence does not establish the group's identity, demonstrate control of Mokhaberat systems, authenticate the purported data or include confirmation from the company.

What people are saying

Observed

DarkWebInformer calls the claim unverified. DailyDarkWeb adds that breach claims involving Iran are often exaggerated and warns that the reported scale would make this a major identity exposure if proven real.

Evolution

Alleged

The posts say the group dated the attack to October 10, 2026 and described it as a 39-day operation. The supplied reports appeared on November 13, but they do not explain the precise start and end points of that claimed operational window.

Reach

Observed

2 independent groups, 2 updates, and 23 engagements.

Technical detail

Alleged

The allegedly extracted material includes usernames and passwords, full names, fathers' names, nationalities, identification-document numbers, birth dates, subscriber and connection records, agency information and virtual-network details. These categories are reported claims, not authenticated contents of a verified dataset.

Sources and evidence

Observed

The evidence consists of two X posts from DailyDarkWeb and DarkWebInformer, both published on November 13, 2026 and both presenting the incident as unverified. No official notice, forensic report, independently tested sample or direct statement from the alleged group is included in the supplied material.