Brinztech Alert: 46M Max.ru (RU Gov Messenger) Leak Includes gosuslugi_ids, Active VPN Access

Dark Web News Analysis

A threat actor is advertising a catastrophic, multi-faceted compromise of Max.ru, which they describe as a “Russian government messenger.” This is not a simple data dump; it is a “keys to the kingdom” breach that includes both a massive user database and active, persistent network access.

The attacker claims to possess:

1. A Full Database Dump: Containing 46,203,590 rows of user data.
2. Persistent Network Access: Live VPN access to Max.ru’s internal network, including their Salesforce instance and other internal tools.

The database itself is exceptionally sensitive, allegedly containing:

• Full PII (Names, Phone Numbers)
• gosuslugi_id (The user ID for Russia’s national government services portal, similar to a US SSN or Login.gov ID)

This is a worst-case scenario: a massive leak of citizens’ “master key” digital IDs, combined with an active, ongoing internal network compromise.

Key Cybersecurity Insights

This data leak presents several immediate, overlapping, and catastrophic threats on a national scale:

• A “Code Red” for Active, Ongoing Espionage: This is the most severe and immediate threat. The attacker isn’t just selling old data; they are selling a live, persistent ticket inside the network. VPN access to internal tools like Salesforce gives them a real-time view of internal communications, customer/user relationship data, government contracts, and operational plans. This is an active, ongoing espionage campaign.
• A “Goldmine” for State-Level Intelligence & Blackmail: This is the #2 threat. A database of 46 million users of a government messenger, complete with their names, phone numbers, and gosuslugi_ids, is a goldmine for hostile intelligence services. It provides a “target package” to identify, profile, monitor, and potentially blackmail millions of Russian citizens, including government officials, military personnel, and their families.
• A “Turnkey” Kit for Mass Identity Theft: The gosuslugi_id is the master key to a Russian citizen’s digital life, used for taxes, healthcare, passports, and more. The leak of 46 million of these IDs paired with names and phone numbers is a “turnkey kit” for mass, irreversible identity theft and financial fraud against the Russian populace.

Mitigation Strategies

In response to a state-level breach of this magnitude, a conventional corporate response is insufficient. This requires an immediate, “scorched earth” national-level security response.

1. “Scorched Earth” Incident Response & Network-Wide Reset: This is an existential, “house is on fire” scenario. Max.ru must assume total network compromise. All VPN access, API keys, and service account credentials must be immediately invalidated and rotated. An enterprise-wide mandatory password reset for all internal and admin accounts is critical. They must engage a top-tier DFIR firm to hunt for persistent attacker backdoors.
2. Assume Total Compromise of gosuslugi_ids: The Russian state must operate as if all 46M+ of these IDs are public. A mandatory, nationwide password reset for the gosuslugi portal should be considered to mitigate the imminent threat of mass identity theft.
3. Maximum Alert for All Users: All users of Max.ru and the gosuslugi portal must assume their PII is public. They must be on maximum alert for hyper-personalized spear-phishing and vishing (voice phishing) attacks. Attackers will use their real name, phone number, and government ID number to build trust and steal further credentials.

Secure Your Business with Brinztech — Global Cybersecurity Solutions Brinztech protects organizations worldwide from evolving cyber threats. Whether you’re a startup or a global enterprise, our expert solutions keep your digital assets safe and your operations running smoothly.

Questions or Feedback? This analysis is based on threat intelligence from a dark web forum. Brinztech provides cybersecurity services worldwide and does not endorse or guarantee the accuracy of external claims. For any inquiries or to report this post, please email: contact@brinztech.com