Russia's Data Leak Penalties: 2.6 Million Rubles in Fines Despite 1.58 Billion Records Exposed in 2025

Half a year before May 30, 2025, the economics of data leaks in Russia were straightforward: the maximum fine for a legal entity stood at 100,000 rubles, rising to 300,000 rubles for repeat offenses. Implementing effective protection against leaks through DLP systems, audits, dedicated staff, and processes cost tens of millions of rubles annually, making breaches cheaper than prevention.

Federal Law 420-FZ of November 30, 2024, linked fines to the number of affected data subjects and introduced a turnover-based component for repeat violations under CoAP RF Article 13.11. Storage of unnecessary records suddenly carried direct financial risk because each excess entry became a line item in potential penalty calculations.

In the 18 months since the norm took effect, authorities conducted 52 administrative investigations, drew up 40 protocols, and imposed a total of 2.6 million rubles in fines. Not a single turnover fine has been applied. These figures stand against 1.581 billion leaked records in 2025, equating to roughly one-sixth of a thousandth of a kopeck per record.

The volume of fresh data leaks from Russian companies fell noticeably in the first half of 2026, yet activity on shadow marketplaces increased by almost 60 percent. Several non-exclusive explanations exist: operators now sell databases privately rather than publishing them openly to protect reputation; businesses have learned to conceal incidents because disclosure became costlier than silence; and some real reduction occurred as companies began questioning data retention periods instead of simply buying more DLP tools.

The core insight is that investment decisions are driven by expected loss rather than actual penalties paid. When the potential damage figure L in the risk equation p × L increased by two orders of magnitude, budgets were approved regardless of enforcement statistics. This effect has a limited shelf life: without turnover fines materializing in the next two to three years, the modeled probability will approach zero and budgets will follow.

Direct costs include the administrative fine, external forensics starting at 1.5 million rubles per medium incident, subject notification campaigns, and legal defense against individual claims. Indirect costs, often larger, encompass customer churn, increased customer acquisition expenses, service downtime, diverted team time, and higher future insurance and audit premiums. In a modeled service with 3 billion rubles annual revenue and an 800,000-client base, a conservative 2 percent churn already dwarfs all other loss categories combined.

Over-collection now appears on the balance sheet as an unhedged liability. Reducing retention periods from three years to six months directly lowers both risk exposure and infrastructure spend, delivering measurable ROI that most organizations still overlook in favor of additional security tooling.