ProShkolu

We noticed a significant data exposure event originating from ProShkolu, a Russian educational portal, that came to light on December 6, 2019. The scale of the compromise, affecting over 1.1 million unique records, immediately flagged it as a high-priority incident. What struck us was the relatively straightforward nature of the exposed data—primarily personally identifiable information (PII)—yet its potential for downstream exploitation remains considerable, especially given the platform's educational focus. The subsequent dissemination of this data on a public Telegram channel further amplifies the risk and urgency of understanding its implications.

The breach of ProShkolu, a database compromise, resulted in the exfiltration of 1,134,890 records. The exposed data fields primarily consist of essential PII: email addresses, phone numbers, first names, and last names. This type of information, while not inherently sensitive in isolation, forms a potent foundation for social engineering attacks, credential stuffing, and targeted phishing campaigns. The source structure of the leak suggests a direct database dump, indicating a potential vulnerability in data access controls or a successful intrusion into the core data repository. The subsequent posting of this data on a Telegram channel highlights the rapid and often uncontrolled distribution of compromised information in the digital underground.

While specific news coverage directly detailing the ProShkolu breach at the time of its discovery was limited, the broader trend of educational platforms becoming targets for data theft is well-documented. Research from various cybersecurity firms consistently points to the attractiveness of student and educator PII for malicious actors seeking to build comprehensive profiles for fraudulent activities. The posting of such data on platforms like Telegram is a recurring theme in OSINT investigations, underscoring the persistent challenge of containing compromised information once it enters these public forums.