The KM.RU Leak: 1.47 Million Russian Accounts Exposed Online

HEROIC analysts identified a database breach connected to KM.RU, a Russian online portal and email service provider. The breach dates to February 29, 2016, and exposed 1,475,842 records. No passwords were included in this leak. The exposed data consisted of email addresses, first and last names, IP addresses, and birthdays. According to reporting at the time, the attack was carried out by hacktivists who said their actions were a protest against Russian foreign policy toward Ukraine.

Why the KM.RU Breach Is Dangerous

Without passwords in the mix, the immediate risk of account takeover is lower. But the combination of a real name, email address, birthday, and IP address is enough to build a convincing profile of a person. That kind of detail is exactly what attackers use for identity theft attempts, targeted phishing, and social engineering, where a message that references your real name and birthday feels far more legitimate than a generic scam email.

What Was Exposed in the KM.RU Leak

• 1,475,842 total records
• Email addresses
• First and last names
• Birthdays
• IP addresses

Why This Matters

Personal details like a full name and birthday are frequently used as identity verification questions or as building blocks for password reset attempts on other accounts. Anyone in this dataset could be targeted with phishing emails that reference accurate personal information, making the message far more convincing than a typical scam attempt. The political motivation behind this breach also means the data was likely distributed widely and quickly, rather than kept private by a single attacker.

How a Database Breach Like This Happens

In this case, the breach was reportedly carried out by politically motivated attackers rather than for financial gain, but the technical method is the same as most database breaches: finding a vulnerability or weakness in the target's systems, gaining unauthorized access, and exporting the user data directly from the backend. Hacktivist-driven breaches like this one are often published publicly and quickly, rather than sold quietly on dark web marketplaces, which can mean faster and wider exposure for those affected.

Check If You're Affected

If you've ever had an account with KM.RU, it's worth checking whether your information appears in this or any other breach. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records in seconds.