Hackers enrolled in schools – Business – Kommersant

The network is spreading information about the largest leak in recent years from the infrastructure of the Moscow City Hall. In free access, presumably, there was an archive of 17 million lines with personal data (full name, SNILS, phone number, date of birth, email address), users of the Moscow Electronic School (MESH). In September of this year, the MES was already subjected to a hacker attack and did not work for several days. The city hall itself denies the leak, and experts admit that the database could have been compiled from other data leaks that have occurred this year. But if the incident is confirmed, the mayor’s office faces a fine of up to 100 thousand rubles.

Today, several Telegram channels specializing in the search for compromised information at once reported a data leak from the MES system. Yes, according to the channel “Information Leaks”, the MES archive containing personal data of metropolitan teachers, schoolchildren and their parents turned out to be freely available. The database contains 17 million lines of data, including full names, mobile phones, dates of birth, email addresses, SNILS, and so on. Channel Data1eaks adds that the archive is current as of August 2021 and contains 3.3 million unique cell phone numbers of users.

Employees of one of the companies in the field of information security, at the request of Kommersant, got acquainted with the database and checked the information from it for compliance with reality.

The company’s specialists told Kommersant that personal data linked to the phone number of at least four employees were found in this database.

The Department of Information Technology (DIT, acts as the MES operator) of Moscow told Kommersant that “the published materials are not related to the real data of the users of the Moscow Electronic School”: “MES services are operating normally, user data is protected.”

Roskomnadzor told Kommersant that they were checking information about a possible data leak.

In September MES servers have undergone serious hacker attack: from September 17 to September 20, some system services were unavailable to users. Officially, the mayor’s office attributed the failures to technical work, but Kommersant’s sources in the cybersecurity market claimed that the service was subjected to a DDoS attack and an attack by ransomware viruses, due to which two servers were encrypted.

This is not the first incident of a major data leak from the mayor’s office infrastructure over the past few years. In December 2020, the data of more than 100,000 patients in Moscow hospitals who had recovered from the coronavirus were freely available. dit then confirmed the leak, citing “human error” as the cause.

According to Yaroslav Shitsle, head of IT & IP Dispute Resolution at Rustam Kurmaev & Partners Law Firm, in the case under consideration, it is probably not only about the leakage of personal data, but also about failure to fulfill the obligation to depersonalize personal data in accordance with the order of Roskomnadzor . In accordance with the current version of the law on the protection of personal data, the mayor’s office must notify Roskomnadzor of the leak, he adds: “At the moment, the legislation does not contain any serious liability for violation of the procedure for processing and storing personal data. We are talking about a fine of up to 100 thousand rubles.”

Nikita Korolev, Yulia Tishina, Tatiana Isakova