Data Leaks Reach Record High in Russia

Sberbank, a majority state-owned banking and financial services company, reported that around 3.5 billion data entries containing personal information of Russian citizens are accessible to the public, affecting nearly 90% of the country’s adult population.

“The situation has long been deplorable,” said Stanislav Kuznetsov, deputy chairman of Sberbank’s board.

Sberbank’s analysis, conducted in late 2023 and early 2024, found that online stores and medical institutions were the primary sources of data leaks. Data breaches peaked in 2023, but leaks continue.

Infowatch, an information security firm, previously reported that a significant quantity of Russian personal data has been exposed. According to the organization, nearly one-third of data breaches in Russia involve large databases containing more than 100,000 records. Many of these databases are associated with various services. In particular, users of the online food ordering platform Yandex.Eda and shipping company SDEK were among those in recent leaks. Government databases have also been compromised: in August 2024, it was reported that the FSB Border Service database, containing information on individuals who crossed Russia’s border from 2014 to 2023, had been leaked.

Leaked data typically includes full names, passport details, phone numbers, residential addresses, and email addresses. Attackers commonly exploit such information for phishing scams and other fraudulent activities, often employing social engineering tactics. As such, an increase in leaks has meant a concurrent increase in scams.

The Bank of Russia reported that, in the second quarter of 2024, fraudsters stole R4.7 billion (nearly $48 million) from bank clients through 257,000 unauthorized transactions.

In 2024, Sberbank recorded a significant increase in fraudulent calls to Russian citizens. “Around February and March, we recorded a peak in phone scams, with about 20 million daily attempts to contact Russian citizens,” Kuznetsov said. He estimated that damages from fraud at the end of 2024 could reach approximately R1 trillion (roughly $10 billion).