Russian Interior Ministry Opens Five Criminal Cases Against 'Glaz Boga' Analog Platforms Selling Personal Data of Russian Citizens
The Ministry of Internal Affairs (MVD) of Russia has opened five criminal cases after identifying several internet platforms that were actively selling personal data belonging to Russian citizens. These services functioned according to the well-known model of «Glaz Boga» (Eye of God), where users could pay a fee and immediately receive comprehensive biographical information about individuals compiled into multiple files.
According to the ministry, the investigations are being conducted under Article 272.1 of the Criminal Code of the Russian Federation. This article specifically criminalizes the illegal use, transfer, collection, and storage of computer information that contains personal data. The platforms in question offered a wide range of confidential information, including passport details, information about bank accounts, and other sensitive records that had been aggregated from various sources.
Law enforcement officers have already seized the servers belonging to these services. Investigators are now examining the seized equipment in detail, studying its contents, and collecting additional evidence to support the criminal proceedings. At this stage, the MVD has not disclosed the names of the platforms involved, the total number of clients who used the services, or the exact volume of personal data that was sold through them.
It also remains unknown how many Russian citizens may have had their information included in these databases. The situation reflects a broader and long-standing problem: repeated large-scale data leaks have turned personal information into a commercial product, while underground services operate as ordinary marketplaces. Instead of offering discounts or delivery services, these platforms sell passports, financial account details, and fragments of private lives to anyone willing to pay.
The operators of the five platforms now face the task of explaining to investigators the origins of the databases they used, the identities of the buyers who purchased access, and the pricing structures applied to different levels of data access.
Related articles
k0t Operators Breach Corporate Firewalls and VPNs Exposing Over 70,000 Credentials
Group-IB and NyxLab detailed a campaign by the operator k0t targeting exposed firewalls and VPN portals. The operation collected more than 70,000 credentials from network devices and LDAP directory extractions across 84 compromised appliances. Initial access relied on CVE-2025-64446 directory traversal in FortiWeb, CVE-2026-0257 authentication bypass in Palo Alto GlobalProtect, and password brute-forcing against FortiGate devices. Attackers then leveraged CVE-2019-6693 to decrypt FortiOS configuration secrets and chained the noPac technique to reach domain administrator privileges. Persistence was achieved through MeshCentral, AdaptixC2, Atera, AnyDesk, and ngrok, while Rclone handled data exfiltration to cloud storage. Victims appeared on the Qilin and The Gentlemen leak sites, suggesting the operators likely act as initial-access brokers rather than direct ransomware affiliates.
OpenCode Reports Possible Exposure of Third-Party API Keys After Legacy System Breach
OpenCode disclosed that an attacker accessed a legacy system on October 16, potentially exposing API keys from external providers that users had stored in the Console. The incident affected only 1.4 percent of Console users, and the targeted system was already undergoing decommissioning. The company described the exposure as possible rather than confirmed and provided no details on the attack vector, duration, or number of keys involved. Some affected users reported unauthorized charges on their provider accounts. OpenCode stated that the incident was limited to keys stored in the Console and did not impact keys saved locally in its command-line or desktop applications. The firm notified impacted users by email on October 17 and is working with Anthropic, OpenAI, and Google. It recommended revoking and rotating exposed keys directly with each provider.
Moscow Court Places Dodo Pizza Cyberattack Suspect Denis Fridman Under House Arrest Until 2026
The Tverskoy District Court of Moscow has ordered Denis Fridman to remain under house arrest until December 8, 2026, in connection with a cyberattack on Dodo Pizza that occurred in late September. Fridman faces charges under paragraphs a and v of part 3 of Article 272.1 of the Russian Criminal Code, which covers the illegal circulation of computer information containing personal data. Investigators detained three of the four suspects after Fridman failed to mask his real IP address while accessing the stolen dataset. The breach lasted two days, but Dodo Pizza quickly blocked access and confirmed that payment details were not compromised because the company does not store them. Authorities notified Roskomnadzor of the incident and implemented measures to forcibly terminate active user sessions where necessary. House arrest remains a preventive measure, and Fridman’s guilt has not yet been established by the court.
Yandex Disk Data Center Incidents Leave Photos and Videos Inaccessible, Custom Recovery Tool Emerges
Following incidents at Yandex data centers in Sasovo and Vladimir, large numbers of photos and videos stored on Yandex Disk became unavailable for normal download. The company attributed the restrictions to load reduction, yet analysis indicates permanent loss of certain data clusters with no confirmed backups. Photos remain partially recoverable through lower-resolution S3 copies such as XXXL and XXL, while videos suffer from missing byte ranges that produce truncated or corrupted files. A researcher developed a specialized tool using mitmproxy to intercept browser requests and download available file variants in parallel streams. The utility also attempts block-by-block video retrieval to salvage whatever segments remain accessible. Users are warned that continued use of the tool may violate service terms and risk account suspension. The developer advises downloading data immediately rather than waiting for potential further degradation.