Anonymous Hack Exposes 150,129 Personal Records from Russian Telecom Provider Convex
What Happened — In February 2023, the Russian telecommunications operator Convex was breached by the hacktivist group “Anonymous.” The attackers published roughly 128 GB of data, revealing 150,129 unique email addresses, IP addresses, names, phone numbers and physical addresses.
Why It Matters for Trust & Control Assurance
- This breach illustrates the risk of inadequate identity and access controls—a core control objective that continuous‑control‑assurance programs are built to monitor and evidence.
- Demonstrable, auditable logs of privileged‑account activity are essential for meeting data‑protection obligations such as those in GDPR.
- Leveraging Verisq’s Access Controls capability enables you to collect, correlate, and retain the evidence needed for a defensible audit trail.
Who Is Affected – Telecommunications providers (TELCO), any organization that stores personal contact information.
Recommended Actions
- Review and tighten privileged‑account provisioning and segregation of duties.
- Deploy continuous monitoring of authentication events and maintain immutable logs for audit readiness.
- Conduct a gap analysis against GDPR’s accountability requirements and map findings to your control‑assurance evidence repository.
Source: Have I Been Pwned – Convex breach
Technical Notes – The public dump contains email, IP, name, phone and physical address data. The exact exploitation technique was not disclosed.
Source: same as above