Comment by jacquesm
17 days ago
Possibly, there is a lot of KYC involved in setting up an eSIM virtual provider but the party that ordered the eSIMs may not be in the know, and the attacker may have obfuscated their credentials or used high quality fakes.
Conveniently, there is no KYC in acquiring a data-only eSIM. KYC is only enforced for the number which is not needed here.