June 2025: Russian Procurement Portal EIS Leaks 46 User Records

HEROIC analysts identified 46 records tied to the Unified Information System in the Procurement Sphere (zakupki.gov.ru) surfacing on June 1, 2025. The leaked data contains email addresses, phone numbers, first names, and last names of users registered on Russia's central government procurement portal (EIS).

Why the EIS Procurement Portal Breach Is Dangerous

A small record count does not mean a small problem. Every person in this file is tied to Russian government procurement, which makes them a targeted pool for phishing, bribery lures, and social engineering. Attackers now have verified contact data for individuals who sit at the intersection of state spending and private suppliers.

What Was Exposed in the EIS Procurement Portal Leak

• Email addresses
• Phone numbers
• First names
• Last names

Why This Matters

Even without passwords, an email plus a phone number plus a full name is high-grade ammunition for credential stuffing elsewhere, account takeover via SIM swap, identity theft, and targeted fraud. State-linked threat actors and criminal crews both value this profile data for follow-on spear phishing and vishing campaigns.

How Database Breaches Happen

Public sector portals like zakupki.gov.ru expose complex web applications and user profile databases. Common entry points include SQL injection, exposed admin endpoints, stolen administrator credentials, and unpatched third-party components. Once inside, attackers dump user tables and often publish the contents on leak forums or paste sites to build reputation or sell access.

Check If You Are Affected

Search your email in HEROIC's breach scanner, which indexes more than 400 billion records from thousands of data breaches. If you match, treat unexpected calls and messages with suspicion, rotate passwords on any account that reused this email, and enable multi-factor authentication on email, banking, and work accounts.