Cyber Incident Victim: Marathon Group
Date:
Mar 2022
Location:
Russia
Summary
A Russian investment firm owned by Alexander Vinokurov, who is under EU sanctions for allegedly providing significant revenue to the Russian government, experienced a data breach involving the leak of 62,000 internal emails. The hacktivist group Anonymous claimed responsibility for the incident, which was subsequently disseminated by DDoSecrets as part of their #OpRussia campaign amid geopolitical tensions related to Ukraine. The compromised data reportedly exposed internal communications of the sanctioned entity.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 3 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 1, 2022, the hacktivist collective Anonymous publicly disclosed a data breach involving the Russian investment firm Marathon Group, leaking approximately 62,000 internal emails. The leaked data was disseminated through the transparency collective Distributed Denial of Secrets (DDoSecrets) and promoted via social media platforms, including a Twitter post by the account @NatSecGeek. The incident was framed as part of Anonymous’ ongoing #OpRussia campaign, which targeted entities perceived as supporting the Russian government during its invasion of Ukraine. No technical details regarding the breach methodology, such as initial access vectors or exploitation techniques, were disclosed in the available source material. Similarly, there was no confirmation of whether Marathon Group detected the intrusion prior to the public leak or implemented containment measures.
The breach directly implicated Marathon Group’s owner, Alexander Vinokurov, who was under European Union sanctions for allegedly providing substantial revenue streams to the Russian government. The leaked emails represented a significant volume of internal corporate communications, though the specific content and sensitivity of the emails were not detailed in the source. The incident amplified scrutiny of Vinokurov’s ties to the Russian state amid broader geopolitical tensions. No statements from Marathon Group or Vinokurov addressing the breach were referenced in the source material, nor were any operational disruptions or financial impacts confirmed. The leak aligned with Anonymous’ stated objective of undermining Russian economic interests in retaliation for the Ukraine invasion, leveraging data exposure as a form of economic and reputational coercion.