Pravy Sektor
Attribution profile
- Type
- Criminal
- Location
- Ukraine
- Known incidents
- 2 incidents
- Sources
- 3 sources
- First seen
- 2016-07-07
- Last seen
- 2016-07-15
- Updated
- 2026-10-11 02:36
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Pravy Sektor (also observed as Pravyy Sector or Pravvy Sector) is a hacker group linked to Ukraine that has targeted government, telecommunications and healthcare entities in Poland and the United States. In July 2016 the group breached Poland’s Defence Ministry, exfiltrating military personnel records, internal documents and intranet logs and then demanded a $50,000 ransom to prevent public release, while also claiming—though analysts deemed it fabricated—to possess evidence of the ministry’s involvement in the US PRISM surveillance program. Shortly before that, in early July 2016, the same actors compromised Poland’s second‑largest telecom provider Netia, extracting roughly 14 GB of customer and corporate data including names, addresses, phone numbers, email addresses, transaction records and session identifiers that allowed unauthorized account access; the data was later posted on underground forums. In August 2016 a Twitter account using the name Pravvy Sector distributed a link to over 150 GB of patient and administrative files stolen from the Central Ohio Urology Group, exposing names, addresses, dates of birth, treatment details and insurance information. The group’s tactics involve server intrusions, bulk data exfiltration (SQL dumps, log files and session‑ID caches), and public leakage via social media or illicit forums. Although the actors claim to represent the Ukrainian nationalist organization Right Sector, no public evidence confirms such an affiliation or any state sponsorship.
Incidents
Attributed incidents are available to members.
2 incidentsSources
Sources available to members: 3 sources.