A whole life for 99 rubles: who sells Russians' personal data, and why the market won't die

How Russia's Telegram lookup bots work, from Eye of God to Himera and NOX: the biggest leaks, arrests of their creators, a new criminal law and the risks.

Kurs Media editorial team30 October 2026, 19:33

The Telegram icon on a smartphone screen, illustrative photo. Photo: Yuri Samoilov, CC BY 2.0

A day's access to NOX costs 99 rubles, about $1.20; a single report on a person costs 39 to 99 rubles. That is what the service's own website says. For that price NOX promises a report built from a name, a phone number, a Telegram account or a photograph: phone numbers, email addresses, passports, home addresses, cars and property, an estimate of income, the number of bank accounts, call history and face search. The service says it checks "more than 400 open sources". The website does not explain how passport details, call records and bank accounts come to be found in open sources. It names its owner as NOX International, a company registered in Lebanon in May 2017.

In October 2026, NOX and another service, Himera Search, found themselves at the centre of a public scandal in Russia. A series of posts on Telegram channels and several regional news sites claimed that information on Russian generals and senior officials could be obtained through them. Most of these pieces relied on the same original material — an investigation published on one Telegram channel, and its reposts. The claims have not been officially confirmed, and neither NOX nor Himera Search has commented publicly. But the subject has moved beyond security specialists: back in February, Russia's Interior Ministry said that such lookup services — known in Russian as "probiv", from a word meaning to punch through — had been used to gather data on soldiers and police officers, including in preparing terrorist attacks.

Chart: according to Roskomnadzor, about 300 million records on Russians leaked in 2023, more than 710 million in 2024 and about 50 million in January–October 2025 — Graphic: «Курс медиа»

To understand how Russia ended up with a market where a dossier on a person costs less than a cup of coffee, one has to go back a few years, to the leaks that fed it.

The turning point came in 2022. Between February and November, databases of large companies were dumped online one after another. In February, two files from the delivery company CDEK with 466 million and 822 million rows appeared; the company called the attack politically motivated. Around 50 million records leaked from Yandex Eda, a food delivery service, at about the same time. In May, an order database of Delivery Club with 350 million rows surfaced, along with the data of 30 million customers of the Gemotest laboratory chain; in the summer, 10 million records of Russian Post; in November, 16 million customer records of the electronics retailer DNS. According to Group-IB, 147.5 million rows were made public between July 2021 and June 2022, compared with 24 million a year earlier. RTK-Solar estimated that, counting unique records, about 100 million people were affected — roughly two-thirds of the population.

The leaks did not stop. Roskomnadzor, Russia's communications regulator, counted 168 database leaks in 2023 containing about 300 million records on Russians. In 2024 there were fewer leaks, 135, but more than 710 million records; a single leak, according to deputy head Milos Wagner, accounted for about 500 million of them. In the first ten months of 2025 the regulator recorded 103 leaks and about 50 million records. Its head, Andrei Lipov, attributed the decline to companies spending more on data protection.

Russia is not unique. The largest known breach in history hit Yahoo: in 2017 the company acknowledged that hackers had gained access in 2013 to all three billion of its user accounts. At the credit bureau Equifax, data on about 147 million people leaked in 2017, and the company agreed to pay up to $700 million in a settlement with US regulators. In 2021 the data of 533 million Facebook* users was posted online, for which Ireland's regulator later fined Meta* €265 million. In 2024 a hacker using the name USDoD put up for sale a database from the US background-check firm National Public Data — 2.9 billion records with names, addresses and Social Security numbers, by his account. Within months the firm's parent company filed for bankruptcy.

The difference between Russia and the West lies less in the scale of the leaks than in what happened to the data next. In the West, stolen databases were traded on hacker forums such as BreachForums, which at its peak had more than 300,000 members and more than 14 billion records. In Russia, leaks became the raw material for a mass retail product: a Telegram bot where anyone, for a few dozen rubles, can get a ready-made profile of someone else.

The best known of these services was Eye of God ("Glaz Boga"). According to the legal news site Pravo.ru, the programmer Yevgeny Antipov developed the platform in January 2020, and a bot for looking up information on people was built on it. Legal trouble came quickly. First a court ruled that a Telegram channel of the same name operated unlawfully. In 2021 Moscow's Tagansky District Court, acting on a prosecutor's claim, declared the information on the service's websites prohibited and sent the ruling to Roskomnadzor. Eye of God said the block would not affect its work — and for a while it did not: the bot kept running, and clones and competitors appeared.

What changed the picture was the law. On 30 November 2024, Russia added Article 272.1 to its Criminal Code, covering the illegal use, transfer, collection and storage of personal data. It took effect on 11 December. The basic offence carries up to four years in prison; creating a website, bot or program to store and distribute such data, up to five; acting as an organised group or causing grave consequences, up to ten. At the same time, a law on turnover-based fines was passed: since 30 May 2025 a company can be fined 1% to 3% of annual revenue for a repeat leak, but no less than 25 million and no more than 500 million rubles.

The market reacted almost immediately. On 27 February 2025, Eye of God stopped working, and reports of searches at its creator's home appeared. Antipov called them fake and attributed the shutdown to disputes with information suppliers in light of the new article. He was reported to be abroad. In March he said that searches had taken place at the service's suppliers in a case opened under the new article. In April 2025 the newspaper Kommersant checked 21 Russian-language bots of this kind and found nine of them not working; by its estimate, about 40% of such services had suspended operations or closed. Some, such as Leak OSINT, began telling users in Russia that access was unavailable. Others moved jurisdiction: Himera Search, according to the paper, took its staff out of Russia for fear of prosecution.

Arrests followed. In August 2025 the Interior Ministry, together with the FSB, shut down a large "information and analytical system" selling detailed dossiers: passport data, home and work addresses, income, credit history. A subscription cost more than a million rubles a month, and more than 66 million rubles had passed through two accounts of linked companies since December 2024. More than 25 TB of databases were seized; the alleged organiser and his assistant were remanded in custody, and more than 2,000 users were being checked. "The functioning of the criminal scheme has been completely stopped," said ministry spokeswoman Irina Volk. The ministry did not name the service.

On 31 October 2025, police in St Petersburg detained Igor Morozkin — according to investigators, the creator and owner of the Userbox bot, widely described as a successor to Eye of God. Volk called it "one of the largest Russian-language Telegram bots distributing citizens' personal data". By the ministry's preliminary estimate, the bot earned 13 million to 16 million rubles a month. More than 40 TB of data and server equipment were seized. On 1 November, Moscow's Tverskoy District Court remanded Morozkin in custody under Article 272.1; his defence appealed. No verdict has been reported, and the most serious part of the article carries up to ten years.

The heaviest sentence reported so far concerns a data source rather than a bot. In October 2026 the Russian outlet Mash reported that a former Moscow police officer had been sentenced to 13 years for selling information from restricted databases — including border-crossing records with citizens' photographs — to the founders of Himera. The officer's name, the court and the charges were not disclosed in the reports. Mash's account of who is behind Himera could not be independently confirmed.

In total, according to the Interior Ministry, 923 crimes under Article 272.1 were registered in the first ten months of 2025. During 2025 the ministry seized 37 servers — 18 physical and 19 virtual, some of them abroad — and more than 200 TB of data, or more than 50 billion rows. Roskomnadzor has said that Telegram blocked more than 8,000 such bots over four years and removes about a hundred every week, but new ones replace them.

Why does the market survive, even though the law has been tightened and leaks have become rarer? The answer appears to be that the raw material has already been gathered. A leaked row stays in circulation for good: the 2022 databases have not disappeared; they are merged with one another and topped up with fresh data. The fact that far fewer records leaked in 2025 changes little for anyone who is already in the old databases. The second source is insiders: the former officer's case shows that the most valuable asset is not a hacked database but access to restricted state registers. The third factor is jurisdiction. Services register abroad, move their staff out and run on a foreign platform, while Russian law reaches first of all those who remain in the country: suppliers, middlemen and buyers.

The consequences of this market show up in official statistics. According to the Interior Ministry, lookup services were linked to more than 13,000 crimes causing over 15 billion rubles in damage in a single month. A fraudster with a ready-made profile no longer has to guess: he knows the victim's name, bank, address and a relative's name, so the call is no longer random. A separate risk is physical security. The ministry speaks openly of data on soldiers, police and officials being gathered before terrorist attacks. Some publications have linked such data to the killings of Lieutenant General Igor Kirillov in December 2024 and Lieutenant General Yaroslav Moskalik in April 2025, but the use of lookup bots in those cases has not been officially confirmed. Finally, the users themselves are at risk. Lawyers note that Article 272.1 is now applied not only to bot owners but also to ordinary employees over minor leaks, and that what counts as illegal data, in the words of the lawyer Alyona Grishkova, "is left to the investigator's discretion".

The next stage is already visible in the services' own descriptions. Face search and photo databases — from passport pictures to social media images — mean that a dossier will soon require neither a name nor a phone number: a single photo will do. Add border-crossing databases of the kind Mash reported being sold, and anonymity in public will cease to exist for anyone whose face appears in at least one leaked database.

For citizens, this means that data from old leaks keeps working for fraudsters, and the defence is no longer against the leak but against its consequences: verifying calls, distrusting callers claiming to be "the bank's security service", and confirming nothing over the phone. We have written separately about the dispute between Russian banks and mobile operators over call labelling, which is meant to help tell legitimate calls from fraudulent ones.

The history of the lookup market shows something else too: blocking bots has only a temporary effect. A closed service is replaced by a new one registered abroad, and the weakest link is not hacked databases but people with legitimate access to restricted registers. The case of the former police officer who, according to Mash, received 13 years is one example. Two conclusions follow. First, the state needs to vet its own employees who have access to official databases — who requested information on a person, when and why. Second, fines for large companies whose databases leak need to become tougher. In Russia, the turnover-based fine for a repeat leak is capped at 500 million rubles, roughly $6 million. In the West the price of failure is different: Equifax agreed to pay up to $700 million in a settlement with US regulators, Ireland's regulator fined Meta* €265 million over a single leak, and the EU's GDPR allows fines of up to 4% of a company's worldwide turnover.

Could vetting those with access to state registers, and fines on a Western scale, finally starve the lookup market of its main raw material?

* Meta Platforms Inc., which owns Facebook and Instagram, has been designated an extremist organisation in Russia and its activities are banned.

Sources

Most sources are in Russian.

Kurs Media editorial team. Corrections and statements from the parties: press@kursmedia.com. Read in Russian.

Sources

More on this topic

"Soon is an elastic concept": the Kremlin responds to Trump on a Putin–Zelensky meeting

Poland: judges backed by Tusk's coalition oust the head of the Constitutional Tribunal

Alexander Zharov: media technology must be our own

Russian gas in Alaska? The Polar LNG project faces claims of hidden ties to Novatek