Cyber Incident Victim: Belarusian Police
Date:
Sep 2020
Location:
Belarus
Summary
Hackers leaked personal information of over 1,000 high-ranking Belarusian police officers, including names, birth dates, positions, and departments, via a publicly accessible spreadsheet shared with an independent news outlet. The group threatened further data releases if violent crackdowns on anti-government protesters continued, prompting the Ministry of Internal Affairs to confirm the breach while vowing prosecution and experiencing a separate DDoS attack that disabled its website. The incident occurred amid nationwide unrest following disputed elections marked by widespread protests, allegations of police brutality, and documented human rights violations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On September 19, 2020, hackers leaked the personal details of 1,003 high-ranking Belarusian police officers in response to violent crackdowns on anti-government protesters. The data, shared via a Google spreadsheet and published by independent news agency Nexta on its Telegram channel, included officers' full names, dates of birth, departments, and job titles—primarily targeting lieutenants, majors, and captains. The hackers explicitly linked the leak to ongoing police violence against demonstrators, warning through Nexta that further disclosures would follow if detentions continued. Nexta publicly solicited assistance from followers to verify the list's accuracy and expand it with additional information, urging citizens to submit details about officers' alleged crimes or personal data through a dedicated bot. The group emphasized anonymity would not protect officers involved in suppression operations, stating "No one will remain anonymous under a balaclava."
The Belarusian Ministry of Internal Affairs acknowledged the data breach while vowing to prosecute those responsible. Concurrently, the Ministry's website became inaccessible due to a distributed denial-of-service (DDoS) attack, though no group claimed responsibility for this disruption. This incident occurred amid sustained nationwide protests following the disputed August 9 presidential election, where opposition candidate Sviatlana Tsikhanouskaya alleged electoral fraud before fleeing the country. United Nations documentation had already recorded extensive police violence during August protests, including beatings, arbitrary arrests, and over 450 documented human rights violations. Despite escalating state responses, mass demonstrations persisted in Minsk and other major cities, with new protests scheduled for September 20. The leak represented a direct retaliation against security forces' actions, operationalizing hacked data as political leverage within the broader context of civil unrest and institutional crisis.