How the OrionNet Database Breach Led to 472,887 Stolen Subscriber Records

HEROIC analysts detected a significant data breach involving OrionNet, a regional Russian telecommunications company providing internet, IPTV, and telephony services across Siberian cities including Krasnoyarsk, Irkutsk, and Novokuznetsk. On August 14, 2025, a large dataset was published on a Telegram channel frequented by data brokers and threat actors, exposing 472,887 subscriber records. The leaked data contained email addresses, phone numbers, full names, birthdates, and plaintext passwords, representing a comprehensive profile of the company's customer base. The inclusion of unencrypted passwords signals a critical failure in OrionNet's data security practices.

Why the OrionNet Breach Is Dangerous

Telecommunications breaches are among the most damaging category of data exposure because telecom companies hold layered identity data. Unlike a simple username-password pair, OrionNet's leaked records combine real names, verified phone numbers, birthdates, and working passwords. This combination enables identity theft, SIM-swapping attacks, account takeover, and targeted phishing. The plaintext passwords are especially alarming: an attacker does not need to crack anything -- they can immediatly test these credentials against email providers, social media platforms, and financial services. With nearly half a million records, the OrionNet breach represents a large-scale threat affecting thousands of real individuals across multiple Russian cities.

What Was Exposed

• Email Address
• Phone Number
• First Name
• Last Name
• Plaintext Password
• Birthday

Why This Matters

Telecom subscriber databases are high-value targets precisely because they contain verified, real-world identity data. Unlike social media profiles where users may provide false information, telecom accounts require accurate details for billing and service delivery. Attackers who obtain this data can use birthdates and phone numbers together to bypass account recovery systems on major platforms, request SIM swaps through mobile carriers, or build highly convincing phishing messages that reference personal details the victim would not expect a scammer to know. The fact that this data was distributed via Telegram rather than a private dark web forum also means it recieved broader exposure and was likely downloaded by dozens or hundreds of threat actors within hours of publication. Breaches of this scale in the telecommunications sector have been linked to downstream waves of SIM-swapping and financial fraud.

How Database Breaches Work

A database breach of this nature typically begins with an attacker identifying a vulnerability in the target organization's infrastructure. Common entry points include unpatched web applications, misconfigured cloud storage buckets, exposed database management interfaces, or compromised administrative credentials. Once inside the system, the attacker locates the subscriber database and exports its contents, often in a structured format such as CSV or SQL dump. In OrionNet's case, the data was likely extracted from a primary subscriber management system, given the consistent structure of the records across multiple data types. The attacker then published the dataset on Telegram, a platform commonly used for distributing stolen data due to its large file transfer capacity and relatively loose moderation. The fact that passwords were stored in plaintext rather than as cryptographic hashes represents a fundamental seperate failure in security architecture that amplified the harm of this breach substantially.

Check If You Were Affected

If you have ever been a subscriber of OrionNet in any of its service regions, your personal information may be included in this dataset. Use the HEROIC free breach scanner to check your email address against more than 400 billion compromised records. Given the sensitivity of the data exposed -- including phone numbers and birthdates -- affected users should also contact their mobile carrier to place a SIM lock on their account, update all passwords associated with the leaked email address, and monitor financial accounts for unusual activity.