Pension Fund of the Russian Federation · Breach

Actor claims leak of 100 million records from Russian pension fund

Nov 03, 2026 · 1 min read

A threat actor claims on an underground forum to have leaked a database from the Pension Fund of the Russian Federation (PFR), with more than 100 million records in about 45 GB of CSV files, and shared samples. According to DailyDarkWeb, the post appears to date from January 2026, the data is described as 2025 records and may be recirculated, and Russian authorities have not confirmed a breach. Claimed fields include SNILS, INN tax IDs, names, dates of birth, partial passport numbers, contacts, addresses, employment history and bank details; if genuine, they are a strong base for fraud and identity theft.

By HIFY Radar newsroom Updated 11/03/2026 10:11 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor posted on an underground forum a dataset they say comes from the Pension Fund of the Russian Federation (PFR), claiming more than 100 million records in about 45 GB of CSV files, with samples shared. The claim is unverified; DailyDarkWeb reports that Russian authorities have not confirmed a breach. The post appears to date from January 2026 and the data is described as 2025 records, which may indicate recirculation.

Why it matters

If genuine, the dataset holds SNILS pension numbers, INN tax IDs, names, dates of birth, partial passport numbers, contacts, addresses, employment history and bank details. Per DailyDarkWeb, that is a strong base for identity theft and fraud against Russian citizens. Companies with staff, customers or operations in Russia may face targeted fraud attempts.

What to do

Treat the claim as unverified and monitor sources for official confirmation. Check whether data on employees, customers or partners in Russia appears in the shared samples. Strengthen authentication and fraud checks for this population.

For the technical team

Affected: Pension Fund of the Russian Federation (PFR), órgão de previdência social da Rússia; base alegada de mais de 100 milhões · Pension Fund of the Russian Federation (PFR); claimed database of more than 100 million records, about 45 GB of CSV files.
Exploitation: Threat actor claim on an underground forum, with samples shared; unconfirmed by Russian authorities, per DailyDarkWeb. Post appears to date from January 2026, with data described as 2025 records, possibly recirculated.
Fix: Not applicable: data breach claim, no software fix reported.
More details: Claimed fields: SNILS pension insurance numbers, INN tax IDs, full names, dates of birth, partial passport numbers, phone numbers, emails, home addresses, employment history and bank account details. Reported by the DailyDarkWeb account; analyst note indicates possible recirculation of 2025 data rather than a fresh breach.