Information warfare out of control. Putin wanted to control the illegal data market, but he unwittingly opened a front for Ukraine

Russian authorities are trying to curb a vast illegal market in leaked personal data, an underground ecosystem tolerated for years by the state but now also exploited by Ukrainian intelligence services.

For more than a decade, the so-called probiv market — a term derived from a colloquial Russian verb meaning “to break into” or “to search a database” — has operated as a parallel information economy. This relied on a network of corrupt officials, traffic cops, bank employees and lower-level security personnel willing to sell access to restricted government or corporate databases.

Although data breaches exist in many countries, the extent and current use of the probe is considered a Russian-specific phenomenon. The system emerged against the backdrop of a deeply corrupt state infrastructure and became useful to both those exploiting the system and those seeking to expose it.

For relatively small sums – sometimes as little as $10 – buyers could obtain passport numbers, home addresses, travel histories, car registrations or internal police records. For higher costs, extensive files on people, including data on phone calls and movements, were available.

A controversial but widely used tool

The use of the probe was controversial, including among Russian journalists, but it was the basis of some important investigations. Among them is the investigation that identified the FSB unit involved in the poisoning of the opponent Alexei Navalnyi.

At the same time, the market was also used by law enforcement and security services, who frequently turned to black market data to track activists, political opponents, or other people deemed undesirable.

“It is one of the paradoxes of modern Russia: these services are illegal and based on leaked data, but they are much more convenient for the daily work of the police than the multitude of official databases,” says Andrei Zaharov, an investigative journalist and author of a recent book on probation.

From tolerance to threat

As the war in Ukraine entered its fourth year, the Kremlin began to view the probib market not as a tolerable convenience but as a direct threat to state security.

Phone scam networks began using the leaked data on an industrial scale, and Ukrainian intelligence services learned to exploit Russian information vulnerabilities to identify and, in some cases, assassinate military officials on Russian soil.

Last year, President Vladimir Putin publicly admitted at his annual question-and-answer session that a close friend had been the victim of a phone scam. According to Zakharov, this was the signal to start a crackdown on the probiv market.

In the past year, Putin has signed laws toughening penalties for data leaks, providing up to 10 years in prison for illegally accessing or sharing personal information. The security services also began an aggressive campaign of arrests and destruction of the probivo infrastructure.

Among the most famous cases was the arrest of the team behind Usersbox, one of the most popular and cheap services of its kind.

An opposite effect to the desired one

According to Zakharov, however, the Kremlin's offensive had the opposite effect. Many of the most important probib operators have moved their activity outside of Russia, where they are no longer constrained by informal understandings with the security services or by the fear of immediate arrests.

“Before, they would cooperate with the services or think twice before publishing something highly sensitive. Now all the brakes have been lifted.” says Zakharov. “Publish one sensitive leak after another.”

He cites as an example the massive data leak known as Kordon-2023, an FSB database that contained information on people who crossed Russia's borders between 2014 and 2023 – one of the most extensive leaks of its kind.

Some well-known services, such as Himera, which were believed to have ties to the authorities, have radically changed their position, announcing that they have cut off access to law enforcement and relocated their staff.

Involvement of Ukrainian hackers

Meanwhile, pro-Ukrainian hacker groups joined the phenomenon. Since the beginning of the full-scale Russian invasion, these groups have repeatedly hacked into Russian government and commercial systems, publishing the data they obtained — often for free and for ideological reasons.

Last year, the Ukrainian group KibOrg published a database of customers of Alfa Bank, Russia's largest private bank. The leak reportedly included personal data of about 24 million people and more than 13 million organizations.

“Viewed as a whole”says Zakharov, “it has never been easier to find private data of Russian citizens on the market.”