@Thanh-Hai Tran @Dark Web Informer :verified_paw:
## Bottom line

**Severity if real: LOW–MODERATE (≈4.0–5.5/10), with HIGH uncertainty on authenticity.** The data shape (email + *partial* phone, no names, no addresses, no credentials/tokens) caps the direct harm at *enablement* — targeted phishing / social engineering / account-takeover assist — rather than a self-contained PII compromise. The $300 price tag and the "partial phone" field are both strong tells that this is either **stale/low-quality data re-sliced from an earlier breach** or a **low-effort scam**, not a fresh high-value 2026 exfiltration.

Treat the post as an *unverified claim*. The forum post is the actor's marketing copy, not evidence.

---

## Why "partial phone numbers" — ranked hypotheses

This is the single most diagnostic detail in the post, and it's not a typo. Four explanations, in order of likelihood:

| # | Hypothesis | Why it fits / why it's a tell |
|---|------------|-------------------------------|
| 1 | **Source data was already masked at the origin** (CRM/marketing pipeline stored `XXX-XX-XXXX` or `area+last4`, or a compliance-masking layer redacted mid-digits) | Most consistent with "partial" being *systemic* across 500k rows, not cherry-picked. Explains why the actor isn't bragging about full phones. |
| 2 | **Actor is redacting the sample to preserve the full dataset's value** (bait technique) | If the 10k sample had full phones, the sample alone would be usable and willingness-to-pay drops. Partial phones in the *advertised* set is a classic "keep the good stuff behind the paywall" move. |
| 3 | **It's a re-slice of the 2025 Salesforce supply-chain breach**, not a 2026 event | The documented Oct-2025 "Scattered LAPSUS$ Hunters" Salesforce campaign exposed ~8.9M SiriusXM-family (Pandora) records incl. email + phone + home address ([obscureiq.com](https://www.obscureiq.com/circulating-data-breach/pandora-mxi/)). An actor can carve 500k rows, mask the phones to look "new," and relabel it `2026-10`. The post's date label is the actor's claim, not ground truth. |
| 4 | **Scam / fake post** — actor doesn't have clean data at all | $300 for 500k rows of *partial* PII from a major brand is commodity/scam pricing. Real fresh full-PII at this scale trades far higher. The "leak in 30 days or no buyer" urgency line is standard pressure framing that adds no real value. |

Note: a *partial* phone (e.g. area code + last 4) is still operationally useful for social engineering — it makes a phishing lure feel personal and can satisfy weak "verify your phone" identity checks when paired with the email — but it **degrades SIM-swap and precision vishing**, which is exactly why the dataset is worth only $300.

---

## Threat model (if the rows are genuine)

- **Primary:** spear-phishing / credential-stuffing / account takeover using email + partial phone as the personalization + identity-verification vector.
- **Secondary:** SIM-swap *assist* is weakened by partial phones (no full number to port), but area+last4 still narrows the target space.
- **Tertiary:** if this is a slice of a larger CRM/stealer-log dump, the *real* exposure is the underlying breach, not this listing. LeakRadar already shows ~168k stealer-log credential matches against the `siriusxm.com` domain ([leakradar.io](https://leakradar.io/en/report/siriusxm.com)) — i.e. credential reuse around this brand is a known, ongoing background condition independent of this post.
- **Not present in the claim:** no passwords, no tokens, no home addresses, no listening/subscription history → no direct financial fraud or deep behavioral profiling from *this* dataset alone.

⚠️ Do **not** conflate this with "Forum Sirius" (French ticketing, 5.9M records, [dailydarkweb.net](https://dailydarkweb.net/threat-actor-claims-to-sell-forum-sirius-database-containing-5-9-million-records/)) — different org, different incident.

---

## Verification playbook (before assigning real severity)

1. **Pull the 10k biteblobs sample.** Inspect: phone field cardinality (full vs `XXX-XX-XXXX` vs `last4`), presence of any other fields (name, address, password hash, JWT, internal ID), row format, and whether emails are `@siriusxm.com` staff vs `@gmail/outlook` customer addresses. Staff-domain emails change the threat class entirely.
2. **Overlap test against the 2025 Salesforce/Pandora 8.9M set** ([obscureiq.com](https://www.obscureiq.com/circulating-data-breach/pandora-mxi/)). If a large fraction of emails already appear there, this is almost certainly a **re-slice of 2025 data relabeled 2026** → drop severity, it's recycled.
3. **Actor vetting:** Shadow2743 = 7 posts, 2 threads, joined May 2026, rep 80, "MVP" badge (a forum status, *not* a trust signal). Low post count + fresh account = consistent with a burner; check for prior data-dump posts and whether samples historically verified.
4. **Check for an official SiriusXM/Pandora 2026-10 disclosure** and any regulatory filing. Absence of a vendor statement (as was the case in the 2025 campaign) is itself a data point — but not proof of falsity.
5. **Price sanity:** $300 / 500k = $0.0006/row. For *partial* PII that's plausible as commodity; for *full* fresh PII it's a red flag that the "full list" is also partial/fake.

**Net:** the "partial phone" detail plus the $300 price plus the date-label mismatch with the documented 2025 breach make me weight **hypotheses 3/4 (recycled data or scam) above a genuine fresh 2026 exfil.** If the sample verifies as full clean PII and doesn't overlap the 2025 set, re-rate to MODERATE-HIGH and escalate to the vendor's incident channel. Until then: low-confidence, low-direct-severity, monitor.