- A hacker called DaOnlySpark claims to hold customer, payment, and eSIM records tied to Phonelyne.
- The alleged data includes 332 user accounts, password hashes, eSIM activation codes, and API key values.
- Nobody has confirmed the claim, and the data’s authenticity and the keys’ validity remain unchecked.
A hacker says they have leaked a customer database linked to Phonelyne. Phonelyne is an eSIM provider that sells mobile data plans to international travelers.
The Dark Web Informer account on X shared the claim. The post raises worries about customer details, payment records, and digital SIM credentials.
DaOnlySpark Lists Orders, Payments and eSIM Records
The hacker goes by the name DaOnlySpark. According to the post, the actor holds records on customer accounts, orders, payment transactions, eSIM subscriptions, and issued eSIMs. The post does not explain how the data was taken. It also does not show that Phonelyne suffered a confirmed security breach.
Phonelyne’s official website says the company sells travel eSIM plans in more than 100 destinations. The company also runs a partner programme. This programme serves travel agencies, resellers, and other businesses. These services match the kinds of customer and partner records in the claim. However, the website does not confirm that any leak took place.
Nigeria Leads the List of Exposed Accounts
The hacker says the dataset holds 1,087 orders and 1,022 payment transactions. It also lists 916 eSIM subscriptions. The actor adds 795 issued eSIMs that cover 54 destinations. Together, these figures describe orders, payments, and eSIM records in one listing.
The claim also names 332 user accounts. Of these, 224 reportedly belong to users in Nigeria. Another 52 belong to users in the United Kingdom, and 23 belong to users in the United States. The available figures do not show where the other accounts sit.
The data reportedly includes customer names, email addresses, and phone numbers. It also contains bcrypt password hashes. The actor claims the dataset holds eSIM ICCIDs, activation codes, API key values, and referral codes. The listing goes beyond regular customers. It reportedly includes 319 partner customer records, it names 19 business travel agency partners. It also holds details on four upstream eSIM providers.
The actor reportedly posted a sample with account details and password hashes. The report does not show whether this sample holds real, current Phonelyne records. It also does not show whether the full dataset matches the description.
Risks Stay Unproven While the Claim Awaits Proof
If the data is real, customers and partners could face several risks. Names, email addresses, and phone numbers could fuel targeted phishing. Criminals could pose as the service and send convincing fake messages. They could also try to trick customers into handing over their login details.
The password hashes could cause trouble too. Attackers may try to crack them and recover the real passwords. Bcrypt is a password-hashing method built to make this harder. Its strength depends partly on its setup and on how strong the passwords are.
The API keys and eSIM activation codes deserve special attention. A valid API key could let an attacker reach protected services or take unauthorized actions. That depends on the permissions tied to the key. A working activation code could also pose a risk. That depends on the provider’s activation controls and on whether the profile is already active.
A similar concern arose in a separate report about threat actors claiming an e-Benefits Prévoyance data breach linked to an API flaw. These are possible outcomes, not confirmed ones. The available information shows no proof that anyone used the credentials or codes to enter accounts or services. The Dark Web Informer post does not say how DaOnlySpark got the database. It also does not say whether the API keys and activation codes still work. Searches for the Phonelyne claim and the name DaOnlySpark found no reliable independent reports.
Phonelyne’s website describes its services and partner network. Still, that information does not show that its systems were compromised. Until more proof appears, readers should treat this as an unverified claim. It is not a confirmed security incident.
Customers should watch for unexpected messages that claim to come from Phonelyne. They should avoid suspicious links. They should never share passwords or verification codes. If Phonelyne confirms the exposure, customers should follow its official guidance on account security and any needed password changes.
Further checks would need three things. These are proof that the data is genuine, a clear link to Phonelyne, and the full scope of any unauthorized access.
Share this article
About the Author
Rebecca James is an IT consultant with forward thinking approach toward developing IT infrastructures of SMEs. She writes to engage with individuals and raise awareness of digital security, privacy, and better IT infrastructure.
More from Rebecca JamesRelated Posts
BeyondTrust Remote Support Zero-Day Exploited by China-Linked Hackers
Google and Mandiant say a suspected China-linked group, Armory Castle, used the flaw before the publ...
GitHub Replaces Stargazer Scraping With Privacy-Focused Star History API
GitHub’s new API shows how a repository’s stars grow over time without revealing who sta...
US Flags China-Linked Hackers in Breach of Pacific Regional Organization
The U.S. Embassy says hackers linked to China infiltrated the systems of a regional group in Suva fo...
French Police Shut Down Reacher and Stryx, Arrest Three 17-Year-Olds
French police arrested three 17-year-olds for allegedly operating the Reacher and Stryx stolen data ...
Privacy Concerns Grow Over Meta Muse Profiles of People Who Never Use the App
WIRED and independent researcher Karan Joshi report that Muse’s instructions tell it to build a page...
ICANN Switches DNS Root to KSK-2024 in Major Internet Security Update
The root zone KSK rollover took place on October 11, the second time since the first one nearly a de...
