The Rostelecom Leak Contains More Exposed Records Than the Population of Denver

HEROIC analysts uncovered the Rostelecom breach while monitoring dark web repositories for newly circulating credential datasets in December 2021. The incident exposed 641,234 user records from the Russian telecommunications provider's database, containing a particularly dangerous combination of data: both bcrypt password hashes and plaintext passwords were present in the same dataset. Analysts who recieved the dump confirmed that email addresses, full names, phone numbers, and IP addresses were also included, giving attackers a complete user profile for each affected account.

Why a Mix of Plaintext and Hashed Passwords Makes This Breach Especially Dangerous

The simultaneous presence of bcrypt hashes and plaintext passwords in the Rostelecom dataset suggests that password security was applied inconsistently across the platform. For the accounts with plaintext passwords, no cracking is required: credentials are immediately usable in automated login attempts. For hashed accounts, bcrypt provides some resistance, but the plaintext passwords from the same breach can reveal patterns that accelerate dictionary and rule-based attacks. Attackers with this data can launch credential stuffing campaigns against email providers, banking platforms, and enterprise systems where the same credentials may have been reused. IP address data is also accessable to buyers, enabling geolocation targeting and infrastructure mapping.

What Was Exposed in the Rostelecom Breach

• Email Address
• First Name
• Last Name
• IP Address
• Phone Number
• Password Hash
• Plaintext Password

Why 641,234 Telecom Records Pose a Long-Term Identity Risk

Telecommunications provider breaches carry elevated risk because users typically register with their real names, active phone numbers, and primary email addresses. Criminals can use the Rostelecom data for account takeover via SIM swapping, identity theft using real names and phone combinations, and financial fraud. IP address data enables attackers to map user locations and correlate accounts across multiple services. Breaches of this kind are also partcularly valuable for social engineering: a phone number paired with a full name is often enough to deceive customer service representatives at financial institutions.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a backend data store, typically through exploiting unpatched software vulnerabilities, SQL injection flaws, or compromised administrative credentials. The attacker then exports user tables in bulk. In this case, the presence of both hashed and plaintext passwords in the same dataset suggests the breach affected multiple database tables or versions of the application with different security configurations.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records, including data from the Rostelecom breach, to tell you instantly whether your email address appears in any known breach. Scan your email for free at HEROIC and take action before attackers use your credentials against you.