Unverified claim: a forum seller calling itself “SaltMobile” advertised more than 1.09 million alleged Salt Mobile customer records on September 18, 2026, complete with sample rows and a price tag. Salt Mobile, one of Switzerland’s major mobile carriers, had not confirmed any breach, intrusion, or data loss at the time trade press indexed the listing. Treat every field count and data type below as actor marketing until the company or a Swiss regulator publishes an attested notice.
The listing surfaced through coverage on Dark Web Informer, which tracks criminal forum sales rather than company disclosures. That matters for how you read a potential Salt Mobile data breach headline: there is no SEC filing, no FADP breach register entry tied to this sale, and no customer letter in the public record—only a seller narrative that the dataset was “scraped” from Salt Mobile systems or processes the actor did not fully describe.
BreachHistory catalogs the incident as an unverified forum claim with an actor-reported census of 1,090,000 records. The canonical record lives at /salt-mobile/salt-mobile-forum2026. If Salt Mobile later confirms exposure, expect the verified field list and headcount to replace or narrow what the seller claimed.
What the seller claimed was inside the dataset
According to Dark Web Informer’s summary of the SaltMobile offer, each row was supposed to represent a customer record with identity and contact material suitable for fraud and social engineering—not payment card numbers or passwords in the published field list, but enough to impersonate someone on the phone or by mail.
The actor-described columns included full names, dates of birth, street addresses broken out into house number, ZIP or postal code, city, and country, email addresses, up to three separate phone number fields, counts of phone numbers associated with the account, and timestamps tied to the record. Sample rows in forum posts are a standard sales tactic; they do not prove the full 1.09 million rows exist, that they are current, or that they came from Salt Mobile rather than from brokers merging public directories with older leaks.
Scraped telecom customer data often mixes billing address, service address, and marketing contact fields. Without a company forensic report, you cannot know whether alleged DOB values came from credit checks, identity verification during signup, or inaccurate third-party enrichment. That uncertainty is normal for unverified Salt Mobile leak claim stories and is exactly why Swiss privacy regulators and the carrier’s own communications team have not been cited confirming the sale.
Timeline: September 18, 2026 and what is missing
The observable public timeline is thin, which is typical when the only source is a criminal marketplace.
- September 18, 2026 — Dark Web Informer publishes on the SaltMobile forum sale alleging 1.09M+ customer records with the field inventory above. BreachHistory indexes the claim the same day with company confirmation still absent.
- Before that date — No attested Salt Mobile statement, Swiss Federal Data Protection and Information Commissioner (FDPIC) notification, or mainstream Swiss telecom regulator bulletin has been tied to this specific dataset in the sources we use.
- After indexing — Any future Salt Mobile confirmation, law-enforcement seizure notice, or sample verification by an independent researcher would change the status of this row; until then, the Switzerland telecom breach 2026 angle remains “market claim only.”
What we do not know includes the alleged entry path (API scraping, partner leak, insider, misconfigured bucket, or pure fabrication), whether mobile account PINs or IMSI secrets were included, whether business or MVNO wholesale accounts are in the set, and whether the count deduplicates one person with multiple lines. The seller used the handle SaltMobile; that branding is not evidence of insider access.
What this is not
To be clear: indexing this claim is not the same as saying Salt Mobile was hacked in a way the company admits. It is not a statement that Swiss mobile networks were broadly compromised, that Salt’s radio access network failed, or that Swisscom or Sunrise customers are in scope. The listing targets the Salt Mobile brand specifically.
It is also not confirmation that all 1.09 million Swiss residents with a mobile phone are affected. Salt Mobile serves a subset of the Swiss market; the actor number may be inflated, duplicated, or include stale accounts. RecordsAffected in the catalog reflects the seller’s marketing figure, labeled unverified.
Who faces the most risk if the data is real
Retail mobile subscribers
If you have or had a Salt Mobile contract or prepaid line, you are the primary audience for fraud that exploits telecom-held identity data. Names plus addresses plus multiple phone numbers simplify targeted SMS phishing (“Your Salt invoice failed—pay here”) and voice vishing where the caller already knows your number and street.
Dates of birth support knowledge-based authentication bypass at banks and retailers that still ask for DOB alongside postcode. They also help attackers answer “verify your identity” flows when porting a number.
Households with multiple lines
The claim of up to three phone fields and phone counts per record suggests family plans or multi-SIM accounts may be represented. Attackers prioritize numbers they believe are linked to the same billing account because compromising one line can unlock account-management portals protected by SMS one-time codes.
Swiss diaspora and cross-border users
Country fields in the alleged schema imply some rows may not be Switzerland-only service addresses. Anyone who maintained a Swiss mobile number while abroad should not assume geographic distance reduces phishing risk; SMS and email reach you wherever you roam.
Who is lower risk on the published field list alone
The actor-described inventory did not include full payment card numbers, IBANs, or plaintext passwords in the Dark Web Informer summary. That does not mean those data classes were untouched in a real intrusion—it means this particular sale narrative emphasized identity and contact columns. Do not relax MFA on Salt self-service portals based only on the seller’s table of fields.
SIM swap and number porting in the Swiss context
Telecom identity leaks feed SIM swap and unauthorized porting workflows even when the leak itself does not contain SIM secrets. An attacker who knows your name, DOB, address, and primary MSISDN can social-engineer a retail shop or call-center agent—sometimes at a different carrier if porting rules allow—or phish you into approving a port.
Switzerland’s mobile market has tightened customer verification over the years, but procedures vary by channel (retail store vs hotline vs online). If Salt Mobile eventually confirms exposure, watch for carrier guidance on port locks, SIM change notifications, and in-app approval for sensitive account changes. Until then, proactive customers can ask Salt whether a port freeze or similar control exists for consumer accounts and enable every account alert the app offers.
FADP (Federal Act on Data Protection) enforcement and notification rules may apply if a controller confirms a breach with risk to individuals; that is a reason to wait for official word before assuming regulatory timelines. Privacy-conscious subscribers can still document their account status and enable transaction alerts on financial accounts that use SMS as a second factor—because SMS 2FA becomes weaker when your number is the asset under attack.
Phishing scenarios tied to this specific claim
Generic “update your password” mail is less convincing than messages that mirror telecom billing cycles. If criminals purchased or sampled this alleged dataset, expect lures that reference Salt Mobile by name and use your real address or partial phone list.
Example SMS: “Salt Mobile: Your September invoice could not be debited. Confirm payment method at [short URL].” The URL may host a clone of My Salt login or a card-skimming page. Real carriers usually push you to the official app or salt.ch, not an unfamiliar domain.
Example email: A message to an address in the leak claims “mandatory GDPR/FADP data refresh” and asks you to upload ID scans to a file-sharing link. Salt Mobile would not collect identity documents through a random hyperlink; Swiss regulators do not ask consumers to email passport copies to third-party Gmail accounts.
Example voice call: “This is Salt retention—your contract ends tomorrow unless you verify the three numbers on the account.” The caller may read phone fields from the dataset to sound legitimate. Hang up and call the number printed on your last official invoice or use the in-app chat.
Example porting phish: “Confirm your number transfer to [competitor]—reply YES to cancel.” A reply may not cancel anything; it may assist social engineering elsewhere. Use official carrier portals only.
None of these scenarios require the 1.09 million rows to be genuine—a smaller sample plus public marketing still enables credible lures. They become more dangerous if full rows match your life details.
How forum sales like this usually appear
Dark-web and adjacent forum markets routinely list “full customer databases” from telecoms, insurers, and retailers. Sellers often reuse the word scraped to imply technical exfiltration without describing authentication, rate limits, or insider involvement. Some listings are repackaged older breaches with new branding; others are partially synthetic datasets built from electoral rolls and marketing files.
September 2026 saw multiple parallel forum claims across sectors indexed by BreachHistory—mobile, utilities, BPO—reflecting a busy criminal market rather than a single coordinated campaign against Switzerland alone. The Salt Mobile listing sits in that context: high headline count, single primary trade-press mirror, no company echo.
Researchers sometimes validate samples by contacting a random subset of emails; no such independent validation was cited in the Dark Web Informer piece at indexing time. Until samples are ethically verified and Salt responds, journalists should keep the unverified label in the lede.
Sector context without overstating the claim
Swiss mobile operators hold rich subscriber profiles because contracts, credit checks, and number portability create longitudinal identity records. That makes telecom a perennial target for both ransomware groups and scraper-driven sellers. Neighboring European markets have seen confirmed telecom breaches where regulators later published attested counts and remediation steps; this Salt story has not reached that stage.
Comparable unverified forum claims elsewhere in the 2026 catalog—large ISP email dumps, energy customer sales—follow the same pattern: actor census, field checklist, company silence at first indexing. Readers comparing incidents should weight company-confirmed SEC filings and AG notices above forum handles.
Internal context on BreachHistory links this claim to other 2026 telecom-adjacent rows such as large ISP email breaches and utility customer data incidents; those are separate victims with separate confirmation status. Do not merge them into one “Swiss cyber week” narrative unless sources connect them—which they do not here.
What Salt Mobile and regulators have said
At catalog indexing, no Salt Mobile press statement, customer FAQ, or filed breach notification was located that confirms theft matching the SaltMobile seller. That absence is materially different from a denial; companies sometimes investigate before speaking. It does mean consumers should rely on official salt.ch channels and in-app notices rather than forum screenshots forwarded on social media.
If confirmation arrives, expect Swiss FDPIC involvement for cross-border or high-risk processing, possible coordination with the Federal Office of Communications (OFCOM) on telecom-specific consumer messaging, and direct customer email or letter campaigns describing affected data classes. None of that had been published for this sale claim when BreachHistory recorded the row.
Was I affected? Practical steps while status is unverified
You cannot look up your name in an official Salt breach portal that does not exist yet. You can still reduce harm from plausible phishing and SIM attacks aimed at Swiss mobile users this week.
- Enable every Salt Mobile account alert for SIM changes, password resets, and new device logins through the official app or web portal—using bookmarks, not links from SMS.
- Ask about port and SIM locks on your line if Salt offers them; document the date and reference number of the call.
- Rotate passwords on email accounts tied to your mobile contract if you reused weak passwords; prioritize the email that receives Salt bills.
- Turn on bank transaction alerts if you use SMS one-time codes; consider switching high-value accounts to app-based authenticators where possible.
- Freeze or monitor credit if you used Salt postpaid services that required credit checks—Swiss credit reporting works differently from U.S. bureaus, but fraud alerts with your bank remain useful.
- Report suspicious Salt-branded messages to Salt’s official abuse or support channel and to Swiss phishing reporting resources; keep screenshots without clicking links.
- Do not pay “delete my data” scammers who claim to have your row from the forum; paying criminals does not remove data and marks you as willing to pay.
- Wait for official confirmation before signing class-action or “breach compensation” forms from unsolicited email; verify law firm or regulator identity independently.
Questions readers search after telecom leak claims
People searching Salt Mobile breach 2026 often want a yes-or-no on exposure. The honest answer today is: a seller says yes; the company has not said yes. That gap is the story.
Questions about whether passwords or call recordings leaked cannot be answered from the published field list. Questions about whether business customers are included are likewise open. If HIBP or a Swiss watchdog later loads verifiable email hashes, that would become a new primary source—update your assumptions then.
Canonical record and sources
BreachHistory tracks this row as 2026 Salt Mobile — 1.09M+ customer records sale claim (unverified). Primary external reference for the claim:
Re-check salt.ch and Swiss news outlets for company statements before treating any field in this article as confirmed fact. If Salt Mobile publishes a denial with forensic backing, the catalog row should be updated to reflect that; if they confirm overlap with the seller’s fields, shift from unverified claim to verified breach guidance using their attested census—not the forum’s 1.09 million headline alone.
Prepaid vs postpaid and what the seller did not specify
Swiss mobile markets mix contract postpaid, prepaid, and business fleets. Forum listings rarely break out those segments, yet remediation differs: postpaid accounts may hold billing addresses tied to credit checks, while prepaid may rely on registration addresses with lighter KYC. The SaltMobile advertisement did not distinguish segments in the Dark Web Informer summary—another reason not to infer uniform exposure across every Salt customer.
Working with carriers after any telecom scare
Whether or not this claim validates, Swiss subscribers can document their ICCID and account PIN status with retail staff on a legitimate store visit, store official correspondence in the app, and avoid sharing one-time codes with callers who already know your address. Those habits matter because telecom phishing does not wait for confirmed breaches.