Hacker puts 10 million records from French contractor Solutions30 up for sale

A hacker using the name Syrv4x is selling a 34 GB database that the listing attributes to Solutions30, a French-founded company whose technicians install and repair equipment in homes and offices for telecom, energy and IT firms across Europe. The listing claims 10,376,950 records, including nearly 4 million distinct names, 6.8 million unique phone numbers and 981,883 unique email addresses, plus customer addresses and the locations where technicians were sent. Solutions30 has not confirmed a breach or commented.

What a sample shows

The French site Cyberattaque.org obtained a sample of 1,500 rows and says the data matches customer and contact records used in Solutions30's work. Of those 1,500 records, 1,309 had a postal address, 840 a phone number, 468 a mobile number and 277 an email address. The structure also has fields for profession, business contact details, company registration numbers and internal references that tie each record to a partner or type of job. Free-text comment fields were filled in on 544 records.

The site found no passwords, bank card numbers or IBANs in the sample. Some older profiles do contain ADSL or VoIP login IDs, the internet plan and the previous provider. Where a subscription date was filled in, it fell between 2008 and 2014, which suggests at least part of the file dates back to PC30, the name the company used when it installed modems and routers for French internet providers.

The total counts come from the seller and could not be checked against the full 34 GB. They also do not mean 10 million different people: one person can appear in several records or be linked to several visits.

Big companies in the file

Solutions30 works on behalf of companies that outsource installation and maintenance, so the data reaches far beyond its own customers. In the sample, Cyberattaque.org found references to BNP Paribas, Carrefour, Thales, Fnac, Renault, Allianz, Dassault and the Banque de France. In 221 records BNP Paribas appeared together with details of its internal structure, down to department and branch. That does not mean these companies were hacked: they appear because Solutions30 did work or handled contacts for them. The seller's list claims more than 160 contracts, clients or job types in banking, retail, telecoms, energy and IT.

Solutions30 says it has more than 16,000 technicians, carries out over 80,000 jobs a day in Europe and has passed 65 million jobs since it was founded in 2003. How Syrv4x got the data is unknown: it could be a recent intrusion, an old server, a business application or a backup found elsewhere. The same seller published nearly 16,000 SFR connection appointment records at the end of September.

The risk: a fake technician

Breaches at contractors are hard for customers to see coming. This week Australia's largest cancer care group confirmed a leak at one of its suppliers. Here the main danger is not direct access to bank accounts but the context the file gives a scammer. Someone who knows your name, address, phone number and which provider sent a technician can call or knock as that technician, about your router, fibre line, meter or payment terminal, and sound convincing. Company staff listed by role and department are also easy targets for tailored phishing.

• If someone calls or comes to the door about a repair you did not book, check it by calling your provider on the number from your contract or its website.
• Do not give a "technician" passwords, one-time codes or bank details, and do not install remote access apps at their request.
• Expect texts and emails that mention a real past visit. A real detail does not make the message genuine.