Russian Medical Data Leaks Explode in July: 88 Million Records Exposed
In July 2026 more than 100 million records containing personal data of Russian citizens appeared in open access. Experts from Perspektivny Monitoring recorded 17 separate leaks originating from commercial organizations, online platforms, government bodies, e-commerce stores and medical institutions.
The medical sector became the main source of the month’s leaks, accounting for 88.37 million records. For comparison, the same sector leaked only 1.7 million records in June and 2.2 million records across March, April and May combined. The sharp rise was caused by just two incidents, one of which involved a large medical information system.
Nikolay Galkin, Head of Cyber Threat Research at Perspektivny Monitoring, noted that medical data has now been leaking for four consecutive months. He added that threat actors are clearly targeting the most confidential categories of information while protection measures in healthcare remain extremely weak.
Other industries also failed to keep their databases secure. The commercial sector lost 11.12 million records, online platforms lost 8.45 million records, government organizations lost 8.36 million records, and internet shops lost an additional 2.1 million records. The government sector reappeared in the statistics after a period of calm; April had seen a record 159 million records leaked from state sources, followed by two months without new public disclosures.
Stolen databases are typically distributed through specialized messenger channels and dark web marketplaces, where the personal information is quickly converted into raw material for fraud operations.
Related articles
SplitVPN Data Breach Exposes Personal Information of 865,000 Users
A data breach at the Russian VPN provider SplitVPN, formerly known as NotVPN, has exposed the personal details of approximately 865,000 users. The incident, which occurred in July 2026, involved a 17 GB SQL database containing emails, IP addresses, geolocation data, and partial payment card information. The stolen material was later distributed on a cybercrime forum, revealing 23.4 million user records, 13.6 million devices, and 2.6 million payment entries. Nearly 58 million connection logs spanning June 2025 to 21 July 2026 were also included, contradicting the company’s previous no-logs policy. The exposure is particularly concerning for users relying on the service to evade censorship and surveillance.
Click to Pray App Exposed Personal Data of 719,000 Users Through Unprotected API Endpoint
Security researcher BobDaHacker discovered an IDOR vulnerability in the official Click to Pray application run by the Pope's Worldwide Prayer Network. The flaw allowed anyone to retrieve full user profiles, including names, emails, countries, and birth dates, by simply incrementing numeric user IDs in API requests. No authorization checks or rate limits were present on the endpoint despite the service holding data for over 719,000 registered accounts. The researcher reported the issue to nine contacts in January 2026 but received no response for seven months. Dark Reading independently verified the exposure before publication, after which the endpoint was quickly restricted. The same service had suffered similar authorization failures in 2019 involving PIN code exposure through its eRosary application. The case highlights persistent gaps in object-level authorization and responsible disclosure channels at the Vatican-backed platform.
Measuring Data Leak Risk by Days of Silence Rather Than Megabytes in Cloud Environments
A financial expert turned security specialist argues that the true cost of data leaks in cloud offices stems not from the volume of exposed files but from the duration they remain undetected. The article details how routine actions such as making documents public, forwarding emails externally, or changing passwords can silently expose sensitive information in platforms like Yandex 360 without triggering any alerts. It warns against blanket prohibitions that push risky behavior into unmonitored channels like personal email or messengers, reducing visibility to zero. Instead, the recommended approach focuses on real-time event-driven notifications combined with automated remediation to minimize the window of exposure. The piece provides a detailed checklist for evaluating monitoring tools, including immediate reaction capabilities, self-healing actions, regular overview reports, and proof of system health. Emphasis is placed on secure integration via OAuth, data residency compliance, and the importance of treating employees as hurried professionals rather than malicious actors.
Russian Interior Ministry Opens Five Criminal Cases Against 'Glaz Boga' Analog Platforms Selling Personal Data of Russian Citizens
The Russian Ministry of Internal Affairs (MVD) has initiated five criminal investigations following the discovery of online platforms that sold personal data of Russian citizens, operating on the same model as the notorious 'Glaz Boga' service. These platforms allowed users to pay for access to detailed biographies and confidential information compiled into multiple files, including passport details, bank account records, and other sensitive personal information. The cases are being investigated under Article 272.1 of the Russian Criminal Code, which addresses the illegal use, transfer, collection, and storage of computer information containing personal data. Authorities have seized the servers of the implicated services and are currently analyzing their contents to gather evidence, although the specific names of the platforms, the number of clients, and the volume of data sold remain undisclosed. The developments highlight how repeated data leaks have transformed personal information into a marketable commodity traded on underground marketplaces, prompting law enforcement action against the operators responsible for distributing such data.