European IT Services Firm Solutions30 Named in 10.3 Million-Record Data Sale Claim

A hacker is allegedly selling a large database tied to Solutions30, a European company that handles tech support and installations for telecoms, energy, and IT firms across the continent.

The threat actor, known as Syrv4x, claims to have taken out 34 GB of data holding 10,376,950 records. Cyberattaque.org first reported this on October 12, 2026. The alleged data reportedly includes names, home addresses, phone numbers, email addresses, company details, partner references, and technical service records.

Cyberattaque.org got hold of a 1,500-record sample and went through it carefully. The review turned up 1,309 postal addresses, 840 phone numbers, 468 mobile numbers, and 277 primary email addresses. The publication said the records looked consistent with customer and contact data from Solutions30’s day-to-day operations.

Sample Points to Years of Customer and Partner Records

The sample also flagged references to some well-known organisations. Names like BNP Paribas, Carrefour, Thales, Fnac, Renault, Allianz, Dassault, and the Banque de France appeared in the records. Seeing those names in the data does not mean their own systems were hacked. The records most likely reflect services Solutions30 carried out for them, or contacts it kept through normal business dealings.

Cyberattaque.org also noted that some of the records look old. The sample contained references to Solutions30’s former name, PC30. It also included older internet services like ADSL and VoIP. Some subscription dates in the sample went as far back as 2008 and 2014. The publication did not find passwords, bank card numbers, or IBANs in the 1,500 records it reviewed. But the data it did find still carries real risks.

A criminal armed with someone’s name, address, phone number, and internet provider could easily fake a technical support call. They could make it sound completely believable. Details about corporate contacts and internal company structures could also help attackers craft convincing phishing emails aimed at employees.

Large-scale data-sale claims have also raised concerns about the exposure of consumer information, including an alleged dark web listing offering 153 million US consumer records for $750, as reported by dark web seller claims.

The method used to get the alleged data is still unknown. Cyberattaque.org said it could not tell whether the data came from a fresh attack on Solutions30’s systems, an old server, a business app, or a backup stored elsewhere.

The hacker also claims the full dataset holds more than 10.3 million unique records. But because Cyberattaque.org only had the sample, it could not verify that number on its own. That figure should not be read as the confirmed number of people affected. As of the report’s publication, Solutions30 had not made any public statement confirming the alleged breach.

Online Reactions Raise Questions About Security Monitoring

The claim drew quick reactions on X. Several users questioned how such a large amount of data could reportedly leave without anyone noticing.

Walter E. Kurtz, posting as @Kurtz69Walter, expressed clear disbelief. Writing in French, he said something to the effect of: 34 GB pulled out over two continuous days, and apparently nobody noticed anything at all.

His comment pointed to a bigger concern. If the hacker’s version of events is accurate, it raises serious questions about what monitoring and security controls were actually in place at the company.

Another user, @lolaventeux41, criticised what they described as a habit of dismissing security concerns. The user suggested that IT teams sometimes treat people who raise red flags as overreacting. They also argued that years of relaxed security habits could eventually catch up with any organisation.

These are individual opinions shared on social media. They do not represent verified findings about Solutions30’s internal security setup.

A third user, @LeCanariSHLH, brought up the legal angle. They pointed to Article 33 of the EU’s General Data Protection Regulation (GDPR). Under that rule, organisations must generally report a personal data breach to the relevant authority within 72 hours of finding out about it. The exception applies only when the breach is unlikely to put people’s rights or freedoms at risk.

Whether Solutions30 falls under that obligation here depends on whether it confirms the breach happened and when it first became aware of any incident.

Scope of the Breach Remains Unconfirmed

At this point, the full scope of the alleged breach remains unconfirmed. Cyberattaque.org’s sample review does show that records connected to Solutions30 are circulating online. But it does not settle how the data was obtained, how many individuals are truly affected, or whether a new security incident actually took place.

Solutions30 has not publicly responded to the claim. The method of access, the true size of the dataset, and the exact timeframe of any possible breach are all still unknown. What the sample does confirm is that real customer and partner records are out there, and the risks tied to that data are not small.