Hackers went to the post office – Newspaper Kommersant No. 6 (7451) dated 01/14/2023

Hackers have published a database of 3.5 million users of the Mail.ru mail service (the number of active users exceeds 46 million). The leak includes email addresses, last names and usernames, as well as phone numbers. VK, which owns Mail.ru, said that the database, which was lost almost a year ago due to the fault of a third-party service, was in the public domain. By themselves, the leaked data is not enough for hacking, experts point out, they can be used by attackers in combination with other databases.

On January 13, a number of telegram channels specializing in information security reported a data leak of users of the mail service Mail.ru (owned by VK), the database was posted on one of the specialized forums on the darknet. A number of resources report that the database was published by the pro-Ukrainian NLB group, which previously published databases of Sportmaster clients, Moscow Electronic School users, Citymobil drivers, etc.

According to the administrators of the Information Leaks channel, the database contains 3.5 million records – this is the email address, phone number of the person who owns the mailbox, as well as his last name and first name. According to the VK website, Mail.ru now has more than 46 million active users.

Information security specialists interviewed by Kommersant confirm the authenticity of the leak. Ashot Hovhannisyan, founder of the DLBI data leak intelligence and darknet monitoring service, clarifies that checking random records from a published leak through the access recovery form on the account.mail.ru website (the service allows you to see part of a registered user’s phone number) showed a match between registered user phone numbers and those specified in database.

“At least the part of the database that is made publicly available includes data from real Mail.ru users,” says Mr. Oganesyan.

The press service of VK “Kommersant” reported that users of the mail service are not in danger and it is reliably protected. The results of the audit showed that “the published data is associated with a leak of a third-party service at the beginning of last year,” the company replied.

There are no passwords and hashes in the Mail.ru user data leak (encrypted codes that are assigned to the user and used for identification), they were not compromised, which reduces the risk of unauthorized access by intruders to mailboxes and other Mail.ru services, explains the executive director of Cross Technologies” Lev Fisenko. “But leaked personal data can be used by attackers, for example, when trying to compromise other services where the user is registered under Mail.ru e-mail, for example, the Gosuslugi portal,” he warns. It is difficult to use such data directly for hacking, agrees Mikhail Berezin, product director of the HFLabs IT company, but they can become an addition when using other previously leaked databases. According to Kaspersky Lab, the amount of personal data that got into the network as a result of the largest leaks in 2022 exceeded 1.5 billion records (see “Kommersant” dated December 16, 2022).

The government has been developing measures to improve data protection in companies since 2022. The Ministry of Digital Development is preparing a bill on turnover fines for companies that have leaked data. The current version of the project provides for a range of fines from 5 million to 500 million rubles. (see “Kommersant” dated December 26, 2022).

Tatyana Isakova