Russia's largest social media platform VKontakte suffers data breach, exposing 390M user records

In a significant security breach, VKontakte (VK), Russia’s largest social media platform, has reportedly had the personal data of over 390 million users compromised. The breach, which occurred in September 2024, was disclosed by a threat actor known as Hikki-Chan on BreachForums, a notorious illicit marketplace. The exposed data was made available for almost free, requiring only minimal forum credits for download.

VK, which boasts 1.1 billion monthly visitors and ranks as the 23rd most visited website globally, primarily caters to a Russian-speaking audience, with 89% of its traffic coming from Russia. The breach has raised serious concerns due to the extensive amount of personal information that has been exposed, including user ID numbers, names, surnames, gender, profile images, and location details such as country and city.

The compromised data was stored in a 27.6GB archive containing 390.4 million records, made accessible through a 7z file format. According to the threat actor, the breach did not occur directly through VK’s infrastructure but was instead the result of a third-party compromise that exposed VK’s data.

This incident is not the first of its kind for VK. The platform has faced several significant data breaches in the past, including a 2022 leak that exposed 32 million records containing personal data, such as full names and links to photos, even from closed or protected accounts. In a 2016 breach, hackers stole 171 million VK accounts and attempted to sell the data online.