Solutions30: hacker claims 10.3 million records, no confirmation

On October 12, 2026, a hacker using the alias Syrv4x put up for sale a database they attribute to Solutions30. The technical services company works as a subcontractor connecting subscribers to Orange and Bouygues Telecom fiber networks, and installing Linky smart meters for Enedis. The hacker claims 34 GB of data and 10,376,950 records. When several specialized sites relayed the announcement on October 12 and 13, Solutions30 had issued no statement on the matter.

What the sample contains

Cyberattaque.org analyzed a 1,500-record sample published by the hacker. The records include names, postal addresses, phone numbers, email addresses, business contact details, internal references, information on subscriptions and installed equipment, as well as free-text comment fields. The site found no passwords, bank card numbers or IBANs in it.

Two points call for caution about the real scale of the leak. First, the subscription dates in the sample range from 2008 to 2014, and several fields mention PC30, the company's former name: at least part of the data therefore appears to be old. Second, the figures are not deduplicated. According to the hacker's figures, relayed by Cyberattaque.org, the database would contain about 6.8 million distinct phone numbers, fewer than one million unique email addresses and about 3.9 million distinct names. Ten million records therefore do not mean ten million people.

Customer data from many sectors

The sample also mentions companies in banking, insurance, retail and industry, such as BNP Paribas, Carrefour, Renault or Allianz, for which Solutions30 carried out work. Cyberattaque.org stresses that these companies were not hacked: they appear because their service provider handled interventions or contacts on their behalf. At this stage, there is no way to know which end customers are affected, or whether files related to Linky meters are in the database.

The hacker says they exploited an IDOR (insecure direct object reference) flaw, which allows access to other users' data by changing a simple identifier. They say they extracted the data in one to two days before being detected. These claims have not been verified.

What to do

• Be wary of calls, text messages or emails claiming to come from a fiber technician, Orange, Bouygues Telecom or Enedis and mentioning your installation: this data makes it possible to build credible scams.
• A real technician never demands immediate payment or bank details over the phone. If in doubt, call your provider back at its official number.
• For companies, this is an opportunity to check what data your subcontractors hold on your customers, and for how long.