How the MegaFon Breach Exposed 80,315 Russian Telecom Subscribers

HEROIC researchers tracked a data leak originating from MegaFon PJSC, one of Russia's largest telecommunications operators, on December 29, 2024. The database compromise exposed 80,315 subscriber records with phone numbers, first names, and last names. The exfiltration pattern indicates a direct compromise of the customer database rather than a superficial front-end scrape, meaning attackers reached core telecom infrastructure.

Why This MegaFon Database Breach Is Dangerous

Telecom breaches fuel SIM swap fraud because the exposed data is the exact input attackers need to impersonate a subscriber to a carrier support desk. A threat actor with MegaFon name-and-number pairs can initiate a port request, intercept SMS-based two-factor authentication codes, and chain the access into banking, email, and crypto-wallet account takeovers. Because telecom identifiers rarely change, the leak remains useful to fraudsters for years.

What Was Exposed in MegaFon

• 80,315 subscriber records from MegaFon's customer database
• Active phone numbers tied to real subscribers
• First names and last names paired to each number
• Data sourced directly from the core customer database

Why This Matters

Name and number pairings are the seed data for SIM swap attacks, smishing at scale, and voice phishing that impersonates MegaFon support. Subscribers face account takeover on any service tied to their phone number, identity theft when the leak is enriched with data from other Russian breaches, and fraud schemes that cite real telecom account details to appear credible. Business users are also at heightened risk of business email compromise tied to their personal mobile numbers.

How Database Breaches Work

Telecom database breaches frequently stem from compromised employee credentials, unpatched internal customer-relationship tools, or malicious insiders selling database exports to external actors. Once an attacker reaches the subscriber table, they extract the records in bulk and route them to leak forums, Telegram channels, or private broker networks. Telecom data commands premium prices in underground markets because it is long-lived and directly enables downstream fraud.

Check If You Are Affected

HEROIC indexes more than 400 billion compromised records across surface web leaks, dark web marketplaces, and telecom data exposures. Run a free scan to find out whether your phone number or name appeared in the MegaFon breach and to see every related dataset that could threaten your accounts.