rmsrf

Profile narrative

The threat actor known by the aliases rmsrf and Roomsurf hacker has been associated with a data breach affecting a college‑roommate matching service. Public sources indicate the actor may be based in Russia, though no further geographic or organizational details have been confirmed. The actor’s activity to date is limited to the reported compromise of the RoomSurf platform, with no additional operations publicly attributed to this identifier.

In January 2018 the RoomSurf service, which helps university students find potential roommates, experienced unauthorized access to its user database. The breach exposed personal information such as names, email addresses, phone numbers, and other details submitted during profile creation. According to the reported incident, the compromised data could be misused for malicious purposes, although the exact attack vector and the actor’s specific methods were not disclosed in the available sources. The breach was covered by a DataBreaches.Net article published in February 2018, which provided further details on the scope of the exposed information. No malware families, tooling styles, or initial access techniques have been linked to this actor in the referenced material. Likewise, no clear strategic objectives such as financial gain, espionage, or disruption have been stated publicly. Consequently, the profile reflects only the confirmed facts: the aliases, the possible Russian location, and the single documented RoomSurf data‑breach incident.

Incidents

Attributed incidents are available to members.