CIAN

We noticed a significant data leak surfacing on December 6, 2025, originating from a Telegram channel. This incident directly impacted CIAN, a prominent Russian online real-estate marketplace. What struck us immediately was the sheer volume of compromised user records, exceeding 4.4 million. The nature of the exposed data, specifically personal identifiers and contact information, raises immediate concerns regarding potential misuse for targeted phishing campaigns and identity theft. The breach's origin within a public messaging platform amplifies the risk of rapid dissemination and exploitation.

The breach, identified on December 6, 2025, involved a database leak affecting 4,445,645 CIAN users. The exposed information comprises phone numbers, first names, and last names. While physical addresses were also reported as exposed, our analysis of the leaked data samples confirms the presence of these core identifiers. The source structure appears to be a direct dump of user account information, likely exfiltrated from CIAN's backend systems. The leak location on a public Telegram channel means the data is readily accessible to a wide range of threat actors, increasing the likelihood of downstream exploitation across various illicit markets.

This incident involving CIAN's user data has garnered some attention within cybersecurity circles, though widespread mainstream news coverage is still developing. Open-source intelligence (OSINT) indicates that similar data leaks from Russian platforms have been observed previously, often attributed to sophisticated actors or insider threats. While specific research directly on this CIAN leak is nascent, it aligns with broader trends of personal identifiable information (PII) being a primary target for data thieves, as highlighted in various threat intelligence reports concerning the Eastern European digital landscape.