Polish authorities recently dismantled a organised criminal gang responsible for a wave of SIM-swapping attacks that drained millions of dollars in cryptocurrency from victims across Europe. The arrests are a reminder that this type of attack is not a distant, exotic threat — it is a repeatable, scalable crime that targets ordinary people and businesses using nothing more than a phone number and stolen personal data.
What Is a SIM-Swapping Attack and Why Should Your Business Care?
A SIM-swap happens when a criminal convinces your mobile network provider to transfer your phone number to a SIM card they control. Once they have your number, any text message sent to you — including the one-time codes used for two-factor authentication — goes straight to them instead. From that point, resetting passwords on email accounts, banking platforms, or cryptocurrency wallets becomes straightforward.
What made the Polish gang particularly dangerous was the groundwork they laid before ever calling a mobile carrier. They sourced stolen personal details from data breaches and infostealer malware logs — the kind of information that circulates freely on dark web markets and Telegram channels. Armed with a victim's name, address, date of birth, and account details, they could pass the identity verification checks that are supposed to keep your number safe.
The Data That Makes SIM-Swapping Possible
This is the part most business owners miss. SIM-swapping does not begin with a phone call to a carrier. It begins weeks or months earlier, when an employee's credentials appear in a breach dump, or when an infostealer infection silently copies saved passwords and browser session cookies from a work laptop.
Criminals compile this background information carefully. By the time they attempt the swap, they already know enough about the target to be convincing. That means the real window to stop an attack is before the criminal ever picks up the phone — at the point where stolen data can still be detected and acted on.
For small and medium businesses, the exposure is often broader than owners realise. A single compromised employee account can hand attackers the personal details they need to go after the business owner, the finance director, or anyone else with access to company funds or sensitive systems.
How Attackers Use Dark Web Data to Target SMBs
Breaches affecting large consumer platforms — loyalty programmes, online retailers, HR software — routinely expose the personal information of business employees. That data flows into dark web markets and infostealer log repositories where it is sold, repackaged, and used in targeted attacks. The criminals arrested in Poland were not elite hackers. They were opportunists who knew how to find and use leaked data efficiently.
For an SMB, the practical risk looks like this: an employee uses the same email address and password across a personal shopping account and a company system. The shopping site suffers a breach. Months later, a criminal buys that record, confirms the credentials still work, and uses the personal details to social-engineer a mobile carrier into reassigning the employee's number. The rest follows quickly.
Monitoring for this kind of exposure across breach databases, infostealer dumps, dark web forums, and public code repositories is not a luxury reserved for large enterprises. It is precisely the kind of early-warning capability that gives smaller organisations a fighting chance.
Steps SMBs Can Take to Reduce SIM-Swapping Risk
The first priority is visibility. You cannot act on a breach you do not know about. Regularly checking whether your organisation's email addresses, employee credentials, or domain-related data have surfaced in known breach data or infostealer logs gives you the chance to force password resets and warn affected staff before criminals weaponise that information.
Beyond monitoring, pushing your team away from SMS-based two-factor authentication — especially for accounts with financial access — is worth the short-term friction. Authenticator apps and hardware security keys do not rely on phone numbers, which means SIM-swapping attacks cannot intercept the codes they generate.
Talk to your mobile provider about adding a PIN or passphrase to your business account before any number transfer can be authorised. It is a simple step that raises the cost of a swap attempt significantly.
SIM-swapping attacks succeed because they connect dots that most organisations never thought to protect. Stolen data from an old breach, a phone number, and a convincing story are all it takes. Knowing where your data has been exposed is the most important first step you can take. Run a free audit at breachrr.com/audit to find out what information about your business is already out there.
Want to see if your company is exposed?