In short: Igor Lyapunov, deputy chairman of Rostelecom's management board, said that more than 370 million records about Russian citizens have surfaced publicly since the start of 2026. According to him, about two-thirds of that data has already appeared in earlier leaks — old records are being repackaged and recirculated under new headlines, including for disinformation-style "info-dumps." In other words, even without a single new breach, your old data keeps working against you.
What Rostelecom actually said
According to Lyapunov, the figure covers the cumulative volume of records found in open access and on underground marketplaces during the incomplete 2026 calendar year. The key point: roughly two-thirds of that dataset isn't the product of new intrusions — it's data from previously known leaks that criminals merge, relabel, and redistribute, often with a fresh "wrapper" presented as supposedly new leaked material. You can read more about how our network-layer protection works on the LiMP VPN features page.
This kind of recycling is common: the same phone numbers, emails, and addresses circulate from database to database for years, gathering new fields along the way — like inferred geolocation or a purchase profile — and resurfacing under a different "leak brand" each time.
Why old leaks get relabeled as new ones
The term Rostelecom's executive used — "vbros" (an information dump or plant) — describes an information-attack tactic: attackers take a long-compromised dataset, present it as a supposedly new, larger-scale breach, and spread it through underground forums and messaging channels. The goal is twofold: sow panic and distrust toward a specific company or agency, and re-monetize the same old data by selling it as a "fresh" database that is, in reality, stale.
For an ordinary person, the difference between a "new" leak and a "repackaged old" one barely matters in practice: once your phone number, email, or ID details have been exposed once, they keep circulating and getting reused for years, regardless of what a given news cycle calls it.
What this means for your data
Every fresh reappearance of old data in the public sphere is a new opportunity for targeted fraud. Scammers use such databases to convincingly pose as bank staff, a telecom operator, or a government agency: knowing your name, phone number, and address lets them build a plausible pretext for a call or message. We've covered the mechanics of these schemes in our piece on phone scams and social engineering.
The scale — 370 million records in under a year — also points to a systemic problem: a single leak rarely stays a "local" incident. Data spreads across dozens of underground marketplaces and stays there for years.
How to protect yourself when your data is already "out there"
- Check whether your email and phone appear in known leaks. Services like Have I Been Pwned show which incidents a given address has appeared in. Not being listed is no guarantee, but appearing is a clear signal to change your passwords.
- Don't trust calls or messages that address you by name and cite "official" details. Knowing your exact name, address, or contract number isn't proof the caller is legitimate — it's a sign they have someone's database in hand.
- Use unique passwords for different services and enable two-factor authentication. This won't stop a data leak, but it prevents one compromised login-password pair from opening every one of your accounts at once.
- Limit how much fresh data you hand to new services. The less new data you give up, the less raw material exists for those repackaging old databases.
- Encrypt your network traffic separately from account hygiene. LiMP VPN hides your device's real IP address from websites and network observers and protects data in transit on untrusted networks — but a VPN cannot erase your data from existing leaked databases; these are different, complementary layers of protection.