Russian Interior Ministry Opens Five Criminal Cases Against 'Glaz Boga' Analog Platforms Selling Personal Data of Russian Citizens

The Russian Ministry of Internal Affairs (MVD) has initiated five criminal investigations following the discovery of online platforms that sold personal data of Russian citizens, operating on the same model as the notorious 'Glaz Boga' service. These platforms allowed users to pay for access to detailed biographies and confidential information compiled into multiple files, including passport details, bank account records, and other sensitive personal information. The cases are being investigated under Article 272.1 of the Russian Criminal Code, which addresses the illegal use, transfer, collection, and storage of computer information containing personal data. Authorities have seized the servers of the implicated services and are currently analyzing their contents to gather evidence, although the specific names of the platforms, the number of clients, and the volume of data sold remain undisclosed. The developments highlight how repeated data leaks have transformed personal information into a marketable commodity traded on underground marketplaces, prompting law enforcement action against the operators responsible for distributing such data.

AntiMalwareJuly 17, 2026Translated from Russian

Read at source

The Ministry of Internal Affairs (MVD) of Russia has opened five criminal cases after identifying several internet platforms that were actively selling personal data belonging to Russian citizens. These services functioned according to the well-known model of «Glaz Boga» (Eye of God), where users could pay a fee and immediately receive comprehensive biographical information about individuals compiled into multiple files.

According to the ministry, the investigations are being conducted under Article 272.1 of the Criminal Code of the Russian Federation. This article specifically criminalizes the illegal use, transfer, collection, and storage of computer information that contains personal data. The platforms in question offered a wide range of confidential information, including passport details, information about bank accounts, and other sensitive records that had been aggregated from various sources.

Law enforcement officers have already seized the servers belonging to these services. Investigators are now examining the seized equipment in detail, studying its contents, and collecting additional evidence to support the criminal proceedings. At this stage, the MVD has not disclosed the names of the platforms involved, the total number of clients who used the services, or the exact volume of personal data that was sold through them.

It also remains unknown how many Russian citizens may have had their information included in these databases. The situation reflects a broader and long-standing problem: repeated large-scale data leaks have turned personal information into a commercial product, while underground services operate as ordinary marketplaces. Instead of offering discounts or delivery services, these platforms sell passports, financial account details, and fragments of private lives to anyone willing to pay.

The operators of the five platforms now face the task of explaining to investigators the origins of the databases they used, the identities of the buyers who purchased access, and the pricing structures applied to different levels of data access.

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Data Breaches & Leaks

Data Breaches & Leaks

Yandex Restores Access to 96% of Yandex Disk Data After Data Center Attacks

Yandex has recovered access to 96 percent of user data stored on Yandex Disk following attacks that damaged its data centers. Files including documents, photographs, and videos are once again available for opening, downloading, and sharing for the majority of users. The company continues to redistribute Disk capacity across independent external sites to improve overall resilience. Basic operations such as uploading, downloading, and synchronization are now functional, yet the web version still imposes restrictions on bulk actions like downloading entire folders or multiple files at once. Users are advised to rely on the desktop client or API for these tasks during the remaining recovery phase. Yandex publishes ongoing updates on the official Yandex 360 service status page and has not provided an exact date for full restoration.

AntiMalwareOct 28, 2026Translated from Russian

Data Breaches & Leaks

k0t Operators Breach Corporate Firewalls and VPNs Exposing Over 70,000 Credentials

Group-IB and NyxLab detailed a campaign by the operator k0t targeting exposed firewalls and VPN portals. The operation collected more than 70,000 credentials from network devices and LDAP directory extractions across 84 compromised appliances. Initial access relied on CVE-2025-64446 directory traversal in FortiWeb, CVE-2026-0257 authentication bypass in Palo Alto GlobalProtect, and password brute-forcing against FortiGate devices. Attackers then leveraged CVE-2019-6693 to decrypt FortiOS configuration secrets and chained the noPac technique to reach domain administrator privileges. Persistence was achieved through MeshCentral, AdaptixC2, Atera, AnyDesk, and ngrok, while Rclone handled data exfiltration to cloud storage. Victims appeared on the Qilin and The Gentlemen leak sites, suggesting the operators likely act as initial-access brokers rather than direct ransomware affiliates.

BoletimSecOct 26, 2026Translated from Portuguese

Data Breaches & Leaks

OpenCode Reports Possible Exposure of Third-Party API Keys After Legacy System Breach

OpenCode disclosed that an attacker accessed a legacy system on October 16, potentially exposing API keys from external providers that users had stored in the Console. The incident affected only 1.4 percent of Console users, and the targeted system was already undergoing decommissioning. The company described the exposure as possible rather than confirmed and provided no details on the attack vector, duration, or number of keys involved. Some affected users reported unauthorized charges on their provider accounts. OpenCode stated that the incident was limited to keys stored in the Console and did not impact keys saved locally in its command-line or desktop applications. The firm notified impacted users by email on October 17 and is working with Anthropic, OpenAI, and Google. It recommended revoking and rotating exposed keys directly with each provider.

BoletimSecOct 20, 2026Translated from Portuguese