- An unidentified hacker has claimed to have over 60.5 million records collected from the Brazilian telecommunications firm Vivo, which are now available in an unspecified dark web forum.
- At a compressed size of 2.5 GB and above 30 GB uncompressed dataset, the hacker organized the dataset into two sub-files, consisting of 28.1 and 32.4 million rows.
- According to specialists in cybersecurity, the origin, authenticity, and uniqueness of this collection are yet unverified.
A threat actor on a dark web forum has claimed to acquire a large quantity of data linked to Vivo, one of the major telecom companies in Brazil. According to a post on the platform, the hacker possesses around 60.5 million records, thus raising serious questions about possible data leaks at the company.
The listed data is 2.5 gigabytes compressed and more than 30 gigabytes expanded. However, security analysts warn about the possibility that the information from the hackers is still unverified.
Dark Web Forum Listing Claims Massive Data Extraction
Underground threat intelligence trackers identified the forum post offering the extensive telecommunications collection for purchase. According to the seller’s listing, the database contains two primary sub-datasets divided across separate files. The first file holds over 28 million individual rows of data, while the second file contains nearly 32.5 million rows.
The combined volume represents one of the largest alleged telecommunications data exposures reported in Latin America. However, the seller’s forum preview screenshots fail to reveal specific underlying data attributes or column structures. Consequently, researchers cannot yet confirm whether the files contain full names, taxpayer identifiers, phone numbers, or call details.
Furthermore, security teams cannot determine if the two sub-datasets contain duplicate records representing overlapping individuals. Without sample validation or raw file audits, industry analysts urge caution regarding the absolute size of the exposure.
Threat Analysts Highlight Significant Verification and Attribution Gaps
Cybersecurity researchers examining the dark web post emphasize that key operational details remain completely unknown. For instance, the listing provides no timeline showing when the intruder allegedly obtained the telecommunications files. Furthermore, the hacker does not provide any technical proof that the data comes from the internal databases of Vivo.
Cybercriminals on the dark web tend to reuse old data dumps, combine stolen records, and inflate the number of records to attract buyers who are willing to pay good money.
Thus, security experts state that the database can contain stolen data from public sources or information bought from other companies. Until independent researchers inspect verified sample files, the attribution to Vivo remains purely speculative.
The Vivo claim comes as cybercrime increasingly shifts to Telegram, where criminal discussions rose from 28% in 2025 to 45% in early 2026. Telegram’s accessibility and automation have made it popular with lower-skilled attackers, while high-value deals still occur on dark web forums.
Telecommunications Sector Faces Growing Dark Web Exploitation Risks
Telecommunication companies hold a large amount of personal data, making them prime targets for hacking groups worldwide. In recent years, hackers have targeted the major companies in the field to acquire customer identification numbers and billing data. Furthermore, stolen telecom data enables malicious actors to launch secondary attacks against financial institutions and consumer accounts.
When criminal groups advertise large telecom datasets on subterranean forums, competing fraud actors move quickly to buy access. As a result, compromised customer data usually moves through various shady avenues, thereby worsening the long-term identity theft threats for consumers. To prevent such threats, telecoms should engage in continuous expansion of dark web surveillance facilities as well as use zero-trust perimeter security measures.
In Brazil, regulatory organizations such as the National Data Protection Authority implement legally binding data protection compliance mandates. Organizations exposed to possible threats should investigate suspicious activity in their networks as soon as possible to manage risks in compliance with local regulations. This means that thorough assessments of crisis events should accompany the cases of hack attempts in an organization.
Essential Defensive Actions for Mobile Users and Network Operators
Mobile users have the chance to implement some firm personal security precautions to lessen the threats from probable database breaches. Customers should implement multi-factor authentication with a relevant authentication app, instead of using SMS messages only. Besides, customers need to be cautious about unsolicited calls or text messages that many demand sensitive bank account information.
Network services must regularly assess the access rights to the database and check internal API routes for unusual information retrieval. Security experts have to use reliable threat detection solutions to identify unauthorized API processes before extensive data file retrieval operations occur. Additionally, protecting stored customer data through encryption helps to keep all retrieved files locked from unauthorized individuals even if they breach the security boundaries.
Collaboration between telecommunications firms and cyber threat intelligence units remains vital to neutralizing illicit data markets. Security researchers should always monitor the listings of underground forums to find compromised assets and inform relevant organizations as soon as possible. One of the best ways to counteract the selling of information on the dark web is to combine quick verification with constant perimeter defense.
