Carriers hold subscriber records and the staff logins that can change an account. DarkThreat watches external sources for stolen credentials and leaked customer files so the security team can act while those accounts are still under carrier control.
A phone number, a call record, and a care-center login are compact and useful. Four patterns show up around that data.
Care agents, retail staff, field technicians, and the contractors who cover nights all receive logins. Those logins reach ticketing tools, account systems, and sometimes the VPN used to support the network. A password stolen from a laptop can be replayed against the same tools.
The leak often surfaces under the carrier email domain, or under a contractor domain whose staff were issued a carrier account. A watch limited to the public brand site will miss the contractor mailbox. What you can register is the domains and portal hostnames the carrier controls.
DarkThreat helps by flagging those credentials in stealer logs, credential lists, and posts. It does not sit in the care desktop. For how stolen logs are traded, see why stealer logs are a security threat.
Moving a phone number, or taking over the online account tied to it, starts with a login someone already trusts. That login may belong to a customer, a retail employee, or a care agent. Once the number moves, mail and banking codes that use the number can move with it.
Where the same account also exposes call detail or other customer proprietary network information, the carrier rules on authentication are in 47 CFR 64.2010. That section requires reasonable measures against unauthorized access to CPNI, and authentication before CPNI is disclosed on a customer call, online, or in a store. A separate paragraph on SIM change requests for commercial mobile radio providers says compliance with that paragraph is not required until the paragraph contains a compliance date. Check the current text before treating it as an active duty.
DarkThreat helps when a staff or portal password shows up outside the carrier, which can be a reason to check whether that identity changed an account. It does not authenticate subscribers, and it does not execute or block a SIM change. Lookalike pages that collect more passwords are a related watch. See typosquatting detection.
A subscriber file is specific. It can include a name, a number, an address, a billing contact, and call detail. Once a copy leaves the account system, it can be described on a ransomware leak site or offered in a forum under the carrier name.
The post is a reason to investigate. It is not, by itself, the notice a telecommunications carrier sends under the CPNI breach rule. That notice has its own recipients and its own timing, described below. The external finding can still be the fact that starts the internal review.
DarkThreat helps by watching for the carrier name and the brands you register on leak sites, paste sites, and underground posts. It does not restore the account system. For how those posts are used as pressure, see monitoring ransomware leak sites.
Dealers, resellers, and outsourced care centers hold logins the carrier issued. A password stolen from a partner laptop can be replayed against a dealer portal or a ticketing tool on a domain the carrier operates. The leak may surface under the partner email domain, not the carrier brand.
Access that lives entirely on a partner system cannot be monitored as if it were the carrier network. What you can do is watch the accounts you issued and the portals you host. Asking a critical partner which email domains its staff use is a contract step. Pretending to see inside the partner office is not.
DarkThreat helps with that external watch. It does not audit the partner network, and it does not decide whether a disclosure of CPNI to that partner was allowed. The disclosure limits sit in the CPNI rules, on the carrier.
Six exposure types a carrier security team can investigate from an external alert.
Passwords for care, retail, and network staff that can be replayed against email, a VPN, or a system that reaches customer accounts.
A stolen care or retail login used to move a number, change an address of record, or open an online account that exposes call detail.
Posts that name the carrier and describe subscriber files, call records, or billing exports copied out of a customer system.
Logins the carrier issued to a dealer, reseller, or outsourcer, replayed against a portal the carrier operates.
Domains that imitate a my-account or dealer portal in order to collect another round of customer and staff passwords.
Vendor and contractor logins that several people know, so one stolen password can reach more than one support queue.
This watch is external. DarkThreat looks for identifiers you provide in places stolen data is posted or sold: stealer-log collections, credential lists, forums, paste sites, and ransomware leak sites. It answers questions a carrier security lead can act on before treating the event as a CPNI breach.
Did an employee, retailer, or contractor password for your domain show up in a stealer log? Did a dealer-portal account you operate appear in a credential list? Is the carrier named on a ransomware leak site, with subscriber files described?
Is someone offering access to the network, or offering files that match a brand, in a forum post? Are lookalike domains imitating an account page in order to collect more passwords?
The same watch will not show activity inside the billing system or the switch. Those stay with the teams that run them. An external finding is a reason to check account-change logs on systems you run. It does not replace that check, and it does not file a notice.
Employee, retail, and contractor logins for domains the carrier registers, including accounts reused from a laptop onto a care tool.
Hostnames for customer-account and dealer portals the carrier operates. A system that belongs only to a partner is outside that watch.
Usernames the carrier created for resellers and outsourcers on systems the carrier controls.
Posts that name the carrier and describe subscriber files, billing exports, or internal support documents.
Underground posts offering network access or files that match carrier or brand names you asked DarkThreat to watch.
Published plans include email notifications and web UI access, so a finding can be read without a separate integration project.
Someone names the identifiers, someone reads the alert, someone resets the account on systems the carrier already runs, and someone keeps the record.
Start with identifiers you can share. That list usually includes carrier domains, retail and care email domains, account-portal hostnames, and partner accounts you issued. A dealer system you do not control is a contract topic.
When a match appears, published plans include email notifications and web UI access, so the security contact can read the finding directly. Triage by role. A password for a care agent who can change an account is a different hour of work from a password for a marketing alias.
The team resets the account, checks whether that identity viewed or changed customer records, and looks for a second account from the same person or the same partner. DarkThreat helps by putting the external finding in front of that team. The reset and the log review happen inside the carrier environment.
Keep the alert, the time, the account, and the action you took. Stolen logs are copied, so leave the same identifiers on the watch list. Where 47 CFR 64.2011 applies, that record can support the review the carrier already runs. DarkThreat does not make the organization compliant with the CPNI rules.
Carrier domains, account-portal hostnames, and partner accounts you issued on systems you control.
A security contact reviews the finding in the web UI or from the email notification included on published plans.
The carrier resets the account on its own systems and checks whether that identity reached customer records.
Save the alert, the account, and the action taken. The record can support a breach review. It is not the law-enforcement notice.
These rules apply to telecommunications carriers, including interconnected VoIP providers as the subpart defines that term. They do not, by themselves, apply to a handset retailer or a tower contractor that is not a carrier. DarkThreat supports external exposure awareness inside the program the carrier already runs. Using DarkThreat does not make a carrier compliant.
Section 64.2001 states that Subpart U implements section 222 of the Communications Act of 1934, 47 U.S.C. 222. The subpart is the Commission set of rules on customer proprietary network information. The current text is on eCFR Subpart U, beginning at 47 CFR 64.2001.
Section 64.2010(a) requires carriers to take reasonable measures to discover and protect against attempts to gain unauthorized access to CPNI, and to authenticate a customer before disclosing CPNI based on a customer-initiated telephone contact, online account access, or an in-store visit. Online access is not allowed on readily available biographical information or account information alone.
DarkThreat helps when a stolen staff or portal credential shows up outside the carrier, which can support that discovery work. It does not authenticate customers, and it does not make a carrier compliant with section 64.2010. The section text is 47 CFR 64.2010.
Section 64.2011, as published in the eCFR, defines a breach as occurring when a person, without authorization or exceeding authorization, has intentionally gained access to, used, or disclosed CPNI. As soon as practicable, and no later than seven business days after reasonable determination of the breach, the carrier electronically notifies the United States Secret Service and the FBI through the central reporting facility.
The carrier does not notify customers or disclose the breach publicly until it has completed that law-enforcement notification. The current text also says the carrier shall not notify customers until seven full business days have passed after notification to those agencies, except where the section allows an earlier notice or a law-enforcement delay. After that process, the carrier notifies affected customers. Breach records are kept for a minimum of two years.
A February 12, 2024 Federal Register document made other Commission amendments effective on March 13, 2024, but it delayed the amendments to 47 CFR 64.2011 indefinitely and said the Commission will publish a later document announcing that effective date. Use the text now in the eCFR, not a summary of amendments that are not yet effective. The delayed-date notice is Data Breach Reporting Requirements, and the section is 47 CFR 64.2011.
DarkThreat helps when a leaked file or a stolen credential is the fact that starts the carrier review. It does not determine whether access was intentional, it does not notify the Secret Service or the FBI, and it does not make a carrier compliant with section 64.2011.
Many carriers also map enterprise IT to the NIST Cybersecurity Framework and operate an ISO/IEC 27001 information security management system beside the CPNI program. DarkThreat helps those efforts with external credential and file-exposure evidence the security team can attach to its own risk record. The guides below describe each framework. They are not a statement that DarkThreat satisfies Subpart U or creates a certified management system.
Plans start at $288/mo. A 7-day free trial is available, and no credit card is required to start. Tell us which carrier domains, account portals, and partner accounts you need watched.
