Cyber Incident Victim: MashOil
Date:
Mar 2022
Location:
Russia
Summary
Anonymous breached two Russian industrial firms, stealing and publicly releasing 112GB of data via torrent links on DDoSecrets to oppose the invasion of Ukraine. The primary victim, an equipment manufacturer, lost 110GB including 140,000 emails, while a construction firm had 2.4GB of emails exposed. Affiliated hacktivist groups confirmed the leaks as part of Operation OpRussia, which aims to expose sensitive oil and gas sector information, with plans to release an additional 1.22TB of data from other critical Russian institutions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around March 29, 2022, the hacktivist collective Anonymous executed a cyber intrusion against MashOil, a Moscow-based industrial equipment manufacturer, and RostProekt, a Russian construction firm. The breach resulted in the theft and subsequent public leakage of 112GB of data, with MashOil accounting for 110GB of the compromised information. The stolen MashOil dataset included 140,000 corporate emails, while RostProekt’s breach involved 2.4GB of email communications. Anonymous affiliates publicly claimed responsibility for the operation through coordinated social media announcements, with @YourAnonNews confirming MashOil’s breach and @DepaixPorteur disclosing RostProekt’s compromise. The collective made the datasets available for public download via torrent distribution through the transparency platform DDoSecrets, facilitating unrestricted access to the stolen information.
The operation formed part of Anonymous’ broader “OpRussia” campaign targeting critical Russian infrastructure entities in retaliation for the invasion of Ukraine. The group explicitly stated the leaks aimed to expose internal communications and operational data from Russia’s industrial sector, particularly focusing on MashOil’s role in oil and gas equipment manufacturing. This incident followed previous Anonymous-affiliated breaches against Russian institutions including the Central Bank and telecommunications regulator Roskomnadzor. Concurrent with the MashOil and RostProekt disclosures, Anonymous announced plans to release an additional 1.22TB of data from unspecified sensitive Russian organizations, indicating sustained intent to compromise strategic economic targets. No public statements from MashOil regarding incident response, containment measures, or forensic investigations were documented in the source material following the breach disclosure.