- A threat actor known as “7by7” claims to be selling a database allegedly linked to Korek Telecom containing more than 750,000 subscriber records.
- The seller alleges the dataset includes fingerprint photographs, raising concerns about potential biometric data exposure.
- Researchers have not independently verified the claims, and Korek Telecom has not publicly confirmed any security incident.
A threat actor has allegedly listed a massive customer database belonging to Korek Telecom for sale on a cybercrime marketplace, raising concerns about the potential exposure of sensitive subscriber information across Iraq.
Dark Web Informer brought attention to the listing after a threat actor operating under the alias “7by7” advertised a dataset that allegedly contains records linked to one of Iraq’s largest telecommunications providers.
The actor claims the database contains information relating to more than 750,000 subscribers. However, cybersecurity researchers have not independently verified the authenticity of the dataset, and no public evidence currently confirms that Korek Telecom suffered a breach.
Despite the lack of verification, the alleged contents of the database have drawn significant attention because of the type of information reportedly included.
Threat Actor Claims Database Contains Fingerprint Images
According to the advertisement, the dataset includes more than standard customer information.
The threat actor claims the records contain fingerprint photographs belonging to subscribers. If true, the incident would involve biometric information, a category of data that security professionals generally consider far more sensitive than names, phone numbers, or email addresses.
The seller reportedly shared sample images to support the claim and indicated that additional samples and pricing information would be provided to interested buyers through direct communication.
Unlike passwords or account credentials, biometric identifiers cannot easily be replaced once exposed. A person can change a password after a compromise, but fingerprints remain permanently tied to an individual’s identity.
Security experts have repeatedly warned that stolen biometric information presents long-term privacy and security challenges because criminals may attempt to misuse it for identity-related fraud or unauthorized verification attempts.
Similar dark web listings target financial data. A cybercriminal claims to be selling 2.3 million Brazilian bank records, highlighting the diverse types of sensitive information traded on underground markets.
The structure of the alleged database remains unclear. The threat actor has not publicly disclosed a complete breakdown of the records, making it difficult to determine what additional subscriber information may accompany the purported fingerprint data.
Telecom Providers Continue to Attract Cybercriminals
Cybercriminals frequently target telecommunications companies because they manage large volumes of customer information.
Mobile operators often store subscriber identities, phone numbers, account information, billing records, service details, device data, and documents collected during customer verification processes. These databases can become valuable commodities in underground markets when attackers gain access to them.
Criminal groups often use telecom-related data to support phishing campaigns, identity theft schemes, SIM-swapping attacks, and account takeover attempts.
The alleged inclusion of biometric information has made this case particularly concerning. If the claims prove accurate, affected individuals could face risks that extend far beyond the exposure of ordinary personal data.
Researchers have long argued that biometric records require stronger protection because they serve as unique identifiers that cannot be reset or replaced after a compromise.
Verification Still Pending as Researchers Urge Caution
While the alleged breach has generated concern, researchers continue to urge caution until independent verification becomes available.
Threat actors on underground forums regularly exaggerate the value, size, or authenticity of datasets in an effort to attract buyers. In some cases, sellers have recycled older data, mixed genuine information with publicly available records, or fabricated portions of datasets to increase interest.
Dark Web Informer noted that the alleged Korek Telecom breach remains unverified. At the time of reporting, no public confirmation had emerged linking the company to a security incident involving customer records.
If investigators eventually validate the claims, the consequences could be significant. A dataset allegedly affecting more than 750,000 subscribers would rank among the more notable telecom-related exposures in the region.
The reported presence of fingerprint photographs would also elevate the incident beyond a conventional data leak and place it firmly within the realm of biometric security concerns.
Affected users could potentially face increased risks of identity fraud, targeted scams, social engineering attacks, and unauthorized account access attempts. The incident could also raise broader questions about how organizations collect, store, and protect biometric information.
For now, the alleged Korek Telecom database remains a claim made by a threat actor seeking buyers on a cybercrime platform. Until security researchers verify the data or Korek Telecom issues an official statement, the true scope and nature of the alleged exposure remain uncertain.
Even so, the listing highlights the growing demand for telecommunications data in underground markets and the increasing importance of protecting biometric information from unauthorized access.
