My Business (Мой Бизнес)

We noticed a significant exposure originating from a Russian government portal, My Business (Мой Бизнес), which serves as a support platform for small and medium enterprises. The breach, discovered on May 1st, 2023, has resulted in the compromise of a substantial number of user records. What struck us immediately was the nature of the compromised data, which, while not containing highly sensitive financial or personal identification details, still represents a considerable risk for targeted social engineering and further exploitation. The leak's subsequent appearance on a public Telegram channel amplifies the immediate concern for affected individuals.

The incident involved a database breach affecting 355,573 unique records. The exposed data fields primarily consist of contact information and basic demographic details: Email Address, Phone Number, First Name, Last Name, and Gender. The source structure of the leak suggests a direct dump from a user registration or profile database. The data was subsequently disseminated via a Telegram channel, making it readily accessible to a wide audience. The primary threat theme here is the potential for large-scale phishing campaigns and targeted spear-phishing attacks, leveraging the combination of email and phone numbers to build trust or impersonate legitimate entities. The gender information, while seemingly innocuous, can further refine targeting for more persuasive social engineering tactics.

While there has been limited direct mainstream news coverage of this specific breach, it aligns with a broader trend of data leaks from government-adjacent entities in the region. Open-source intelligence (OSINT) indicates that the My Business (Мой Бизнес) portal is a critical resource for entrepreneurs, making the compromise of its user data particularly concerning for the business community it serves. Research into similar incidents involving Russian government or quasi-government platforms suggests a persistent vulnerability to database exfiltration, often facilitated by SQL injection or compromised credentials. The dissemination on Telegram is a common tactic for threat actors seeking broad reach and a degree of anonymity.