The Alleged Nokia Data Breach by Tsar0Byte: What Is Claimed, What Is Confirmed

Key takeaways

• This is an unverified claim by a threat actor, reported at the time on forums. We cannot confirm that Nokia was breached.
• The reported number was over 94,500 employee records, which is the actor's claim, not a verified count.
• The claimed route was a third-party vendor, which fits a common supply chain risk pattern.
• Breach claims can be exaggerated, recycled from old leaks or fabricated, so look for confirmation from the company or a regulator.
• Employees of any large company should use unique passwords and MFA and expect phishing after such claims.

What was claimed?

According to reports circulating at the time, an actor using the alias Tsar0Byte posted on a forum called DarkForums, claiming access to Nokia systems through a third-party vendor and offering data allegedly covering more than 94,500 employees. The post reportedly listed items such as names, job titles, email addresses and hashed passwords, plus internal documents.

The original version of this article said "2026" in its title and described the claim in more detail than the evidence supports. Those details are claims made by the poster. We have not seen confirmation from Nokia that we can cite, and the status may have changed. Please check Nokia's official channels for any statement.

Is Nokia's network hacked?

We cannot say. A claim on a forum is not proof. Companies often take days or weeks to investigate, and some claims turn out to be old data, data from a supplier, or invented.

How do you judge a breach claim?

What does the third-party angle teach?

If a vendor link was the way in, as claimed, it is an example of supply chain risk. Large companies rely on many suppliers, and each connection can be a way in. Controls that help:

1. Inventory vendors and the access each one has.
2. Give least privilege and time-limited access to vendors.
3. Require MFA for vendor accounts and log their activity.
4. Segment vendor connections from core networks.
5. Include security terms and breach notification duties in contracts.
6. Plan for vendor incidents in your response playbook.

See other recent incidents for comparison: the Oracle cloud data breach dispute, the Kellogg's data breach and the Cipla cyberattack.

What should employees and partners do?

• Do not assume you are affected, but act as if you could be: use unique passwords and enable multi-factor authentication.
• Expect targeted phishing that uses real names, titles and project details.
• Report suspicious messages to your security team.
• Do not download or share any "leaked" data. It may contain malware and may breach law.

Indian organisations can report incidents to CERT-In. MITRE's ATT&CK describes supply chain compromise techniques.

Common mistakes when reading breach news

• Treating an alleged breach as confirmed.
• Repeating a record count without a source.
• Searching for leaked data yourself, which is risky and may be illegal.

Next steps

Next steps: to learn how organisations investigate incidents like this, see our Certified Incident Handler course, and read about the Kellogg's breach.

Related reading

• What happened in the June 2025 WestJet cyber attack and how did it impact their systems?