HEROIC Analysts Found the Sim.rs Dump Circulating on the Dark Web

In June 2025, HEROIC found 29,026 phone numbers, first names, last names, and birthdates from Sim.rs exposed on a Telegram channel. The data came from a now-defunct Serbian forum serving Discord communities, streaming groups, and Balkans-based niche online communities.

Why the Sim.rs Breach Is Dangerous

This dataset combines real names, phone numbers, and birthdates, which is enough information for attackers to build targeted phishing messages, commit SIM swapping attacks, or verify identities on platforms that use SMS for two-factor authentication. Community forum users are also at risk of doxxing given the combination of personal identifiers exposed.

What Was Exposed in the Sim.rs Leak

• Phone numbers
• First names
• Last names
• Birthdates

Why This Sim.rs Data Puts You at Risk

With a name, phone number, and birthdate, an attacker has enough to impersonate victims for SIM swap attacks, account recovery requests, and social engineering. SIM swapping lets attackers redirect SMS two-factor authentication to their own devices, effectively bypassing security protections on banking, cryptocurrency, and social media accounts.

How a Database Breach Works

In a database breach, attackers extract records directly from an organization's stored data, often by exploiting vulnerabilities in the web application or backend infrastructure. The stolen data is distributed through channels like Telegram, where it reaches a broad audience of threat actors. Even without passwords, personal identifiers like those exposed here enable follow-on attacks including SIM swapping and identity fraud.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the Sim.rs leak or thousands of other breaches in our database.