Russia's Database Leaks Drop 40%, Still 538M Rows
In short: Russian cybersecurity firm F6 reports that in January–September 2026, Russian company databases were published in open access 119 times — 40% fewer than the 198 publications seen in the same period of 2025. Yet the total volume barely dropped: 538 million rows leaked in 2026 versus 611 million a year earlier, just 12% less. Fewer leaks does not mean less data at risk, and if you've shared your data with any Russian online service, it's worth checking whether it has already surfaced — see our guide to checking for a personal-data leak.
What F6 found
According to F6's report, covered by CNews and F6's own post on Habr, analysts tracked 119 cases of Russian company databases appearing in public access between January and September 2026, down from 198 over the same nine months of 2025 — a 40% drop in the number of publications. The combined volume of leaked rows fell far less sharply: 538 million in 2026 against 611 million in 2025, a decline of only 12%. In the third quarter alone (July–September), 29 new leak cases surfaced, 17% fewer than the 35 recorded in the same quarter of 2025.
Why publications are declining, but not the data itself
F6 attributes the drop in publication counts to the same factors analysts have cited throughout 2026: reduced activity on underground Telegram channels that used to distribute stolen databases, instability and outright shutdowns of several dark-web forums, and new bans on some popular underground platforms against posting data tied to Russian and CIS organizations. In other words, the pipeline that turns a breach into a public leak has gotten narrower — but the breaches behind it keep happening at nearly the same scale, which is why total exposed rows fell by only 12% while publication counts fell by 40%. Fewer public posts can also mean attackers increasingly monetize stolen data privately (direct sale, extortion) rather than publishing it for reputation, which is arguably worse for the people whose data it is, since there's no public record to check against.
Who keeps ending up in leaks
F6 and outlets covering the report point to IT companies, retail and e-commerce, and government organizations as the sectors most frequently represented among third-quarter 2026 leaks. The leaked fields are the familiar set: names, phone numbers, email addresses, home addresses, dates of birth, and in some cases passport details and passwords — exactly the information needed for targeted phishing, SIM-swap attempts, or credential-stuffing against other accounts.
What this means if you live and shop online in Russia
A 40% drop in publications is good news about visibility, not necessarily about your personal risk. With 538 million rows still surfacing in nine months, the practical odds that at least one service you've used has leaked some of your data remain high — and a quieter underground market means a leak might never even get you a notification. Reusing the same password across services, or giving your real name, address, and phone number to every online service that asks, multiplies how many of those 538 million rows could be yours.
How to reduce the damage from leaks you can't prevent
You can't stop a retailer or a government portal's database from leaking — that responsibility sits with the organization. But two habits limit what a leak can actually do to you. First, use a password manager so a breach at one service never reuses your credentials elsewhere; see our walkthrough on choosing and using a password manager safely. Second, reduce what network operators and sites can observe about you in the first place: encrypting your connection with the LiMP VPN app for Android, Windows, or Chrome, backed by a no-logs policy, means there's no activity journal on the VPN side to add to the next leak.
Sources
Frequently asked questions
Does this mean less data is actually leaking?
No. The number of publications fell 40%, but the total volume of leaked rows dropped only 12% (538M vs. 611M) — breaches are still happening at nearly the same scale, just fewer become public.
Why have fewer leaks been published?
F6 cites reduced activity on Telegram channels that distributed stolen databases, instability and closures of some dark-web forums, and new bans on posting data tied to Russian and CIS organizations on certain platforms.
How can I tell if my data was already in a leak?
Check your email and phone number against breach-checking services — our guide to checking for a personal-data leak walks through the process.