FIREGOD

Internal records of the Military Training Center (ВУЦ) at the Kaluga branch of Bauman Moscow State Technical University, a state institution running military training for Russian service branches. The corpus totals 1,944 files. Released here are the institutional and doctrinal records: training presentations, information bulletins, academic assessment regulations, methodological plans, and patriotic education material.

1,724 files are withheld. Every file was machine scanned for personal identifiers — patronymic forms, surname and initials, phone, email, SNILS and passport patterns, dates of birth. A file was released only if extraction succeeded and no identifier was found. Withheld material names private individuals, including minors: student and staff rosters, muster rolls, academic debt lists, medical and blood donation rosters, and individual petitions. Those are not published.

In June 2026 a data set attributed to the extortion group ShinyHunters was published from American Tower Corporation, a major United States owner and operator of wireless communications towers (NYSE: AMT). Have I Been Pwned indexed 216,601 affected accounts on 26 June 2026. Fields confirmed through that indexing are names, email addresses, job titles, phone numbers, and physical addresses, spanning employees, contractors, customers, and leads.

The published set is structured as exports from enterprise business platforms. Object names are consistent with a Salesforce customer relationship management instance (account, contact, lead, opportunity, and case objects) and a ServiceNow service management instance (user directory and configuration management database). Assessment: the exposure most likely originated from a compromised cloud business application rather than core tower or network infrastructure. Confidence is moderate, drawn from the structure of the data.

ShinyHunters operated a pay or leak extortion model and claimed a larger haul, reportedly more than 5.2 million records including landowner information, tower asset records, geographic coordinates, site access codes, and internal documents, with references to third party carriers and a federal agency. Those larger figures are self reported by the actor and are not independently confirmed in open reporting. Impact: the confirmed fields alone support credible phishing and social engineering against named staff and customers, and if the actor claims hold, site coordinates and access codes would carry a physical security dimension.

HANDLING. This case file is assessment only. No records, credentials, or access codes are reproduced or hosted on this site. Characterization is built from public breach reporting and a structural review of field names.

Since 2022, open reporting has documented the largest known personal information leaks on record originating from China, ranging from the Shanghai National Police database of roughly one billion residents to aggregated collections measured in the billions of records traded on criminal forums. This case frames two representative sets within that ecosystem.

The first is a roster of approximately 1.96 million members of a regional party organization, concentrated in the Shanghai municipality. Aggregate profiling of the set, with no individual record reproduced, shows eleven fields including full name, national identity number, registered origin, employer or branch, residential address, and mobile number. National identity numbers are present and well formed for roughly 99 percent of entries. The second set is structured as housing provident fund records that pair names with national identity numbers, mobile numbers, and employers.

Impact: a national identity number joined to a name and a contact field is sufficient for identity fraud, account takeover, and targeted fraud at scale. Affiliation and employer fields add a targeting and coercion dimension that a routine consumer breach does not carry, so sensitivity is assessed as high. Attribution: these sets sit inside a widely reported and already public leak ecosystem and none is a novel or unclaimed discovery. The analytic value here is characterization and risk framing rather than disclosure.

HANDLING. Assessment only. No names, identity numbers, or contact records are reproduced or hosted on this site. All figures are aggregate counts.

In early October 2026 Danish authorities disclosed a breach of the Central Person Register (CPR), the national population register, exposing data on roughly 8.8 million people, close to the entire population of Denmark. Reported fields include full names, addresses, CPR numbers, marital status, family relationships, and church affiliation. Records for individuals with address protection were reportedly not exposed.

The exposure did not come from a direct intrusion into the register. Public reporting indicates a private company's legitimate access to CPR was abused by unauthorized parties, who ran roughly 14 million lookups over about ten days before the activity was noticed through a billing anomaly. Assessment: this is a third party access and trust failure rather than a perimeter breach, and a national identifier joined to name, address, and family data supports identity fraud and targeted social engineering at population scale. Sensitivity is assessed as high. No threat actor has been publicly named. Confidence is moderate to high, drawn from consistent reporting across multiple outlets.

HANDLING. This case file is assessment only. No records are reproduced or hosted on this site. Characterization is built from public breach reporting.