Metascan Confirms Limited Data Breach After Two-Minute Telegram Bot Compromise

Metascan, a company providing vulnerability scanning and information security services, has confirmed an internal data leak and released the findings of its investigation. According to the company, an attacker remained in a corporate Telegram chat for roughly two minutes and managed to export only a limited set of documents.

The incident occurred in the early hours of September 5. The attacker used a compromised administrative token belonging to a Telegram bot and added a fake account disguised as an HR employee. Export of the chat began at 02:02 and was interrupted at 02:04 when the account was removed. The bot itself had no access to client chats but held administrator rights in the internal corporate chat.

The company stated that the attacker obtained a small volume of data, including two pilot project reports dated July 2026. Earlier, the threat actors published internal documents and screenshots referencing Transneft, Selectel, Lenta, Sberbank, Rostelecom and other large organizations. They also alleged that Metascan had concealed client vulnerabilities to sell remediation services later. Metascan rejected these claims and linked the publication to a former employee now cooperating with a competitor.

The root cause was identified as an internal error: while primary tokens were revoked upon the employee’s departure, a token remained active on test virtual machines. Metascan has fully accepted responsibility, announced plans to strengthen technical controls, and stated its intention to pursue legal assessment of the actions involved. The company has also launched a vulnerability disclosure program, accepting reports at bb@metascan.ru prior to publication on specialized platforms.