An ICCID column is what makes the unverified Claro list worth acting on

The claimed record has nine fields, according to the dev.to writeup describing the listing ^[2]. Eight of them describe an account: the identity document number, the phone number, subscription details, account status, plan category, activation date, billing cycle and internal codes ^[2][1]. The ninth is the ICCID, the unique identifier of a single SIM card ^[3]. "El ICCID no es un dato de mercadeo: identifica una SIM en concreto," the post wrote ^[4]. In English: it is not marketing data, it points at one specific card.

The post's argument is that the ICCID is the field that lets an attacker act on the record ^[5]. The two attacks it describes are ordinary ones. First, the call that already knows things about you. With the document number, phone, plan and billing cycle, a caller can state your name, your cedula, your plan and your billing date, and the post notes that every security question a bank asks over the phone sits in that list ^[8]. Second, the SIM change: persuade a service point that you are the customer, move the number to another SIM, inherit the messages ^[6]. SMS is still the second factor for banks, email and social accounts in the country, so whoever holds the number can request the recovery code for everything else ^[7].

What is established is thin. The post says the claim has not been independently verified, and that the circulating samples cannot by themselves establish the origin of the data, its recency, its completeness, or that it came from the company's systems ^[9]. Confirmation also tends to arrive late: verification comes first, then the decision about what to communicate, and the post puts that at days or weeks ^[16]. Whatever was circulating has circulated by then. Claro Dominicana has not publicly confirmed any incident ^[10].

The defenses the post ranks first work whether or not any of that resolves. Move the second factor off SMS to an authenticator app where you can; the post calls this the change with the most effect per minute invested, and the only one that still protects you if your number stops being yours ^[12]. Ask your carrier what it takes to move your number to a new SIM. If the answer is a phone call, the post says that is the problem, and to ask for in-person presence or an extra passphrase where the operator offers one ^[13]. Set the SIM PIN in the phone's security menu; it takes a minute and blocks the simple case of a stolen handset with the card pulled out ^[14]. Do not read a code out loud, because no bank, carrier or app asks by phone for the code that just arrived ^[15].

For anyone running systems for Dominican customers, two assumptions change. The first is the SMS one-time code, which the post calls a borrowed factor ^[18]. The second is the document number. Knowing someone's cedula was never good proof of identity, and the post's line is that it now proves nothing ^[19]. The cedula and the phone number are not secrets, and the post says a system that verifies identity by asking for the document number checks nothing; account recovery that leans on it is public ^[17].