VKontakte 2012 Data Breach
ObscureIQ Breach Intelligence
Low SeverityWebsite / service breach
VK (VKontakte) Russian Social Network Credential Breach (2012, Disclosed 2016): 93 Million User Accounts Including Passwords Exposed
Russian social networking platform.
Verified by ObscureIQ Intelligence
12/100Breach Risk Index
5Data Value
10Market Recency
3609dSince Breach
Breach Intelligence Summary
Entity: VKontakte · Actor: Unknown · Sources: 3 references
Attack: Misconfiguration
Profile: Platform · Social networking and messaging · Social media platform · Russia / Global
Timeline: Breach (2012-01-01) · Indexed (Jun 09, 2016) · Year (2012)
Exposure: 93.3M records · 4 fields: Email Address, Full Name, Password, Phone Number
Status: Reported
Executive Summary
VKontakte, Russia's largest social network, suffered a credential-theft breach around late 2012 that exposed approximately 93 million user accounts. The intrusion went undetected for nearly four years before surfacing on 5 June 2016, when a hacker known as "Peace" listed the stolen data for sale on a Tor-based dark web marketplace for 1 Bitcoin. The breach is attributed to a misconfiguration that allowed direct access to user account data. The exposed data included full names, email addresses, phone numbers, and passwords. The passwords were stored using unsalted MD5 hashing, an extremely weak protection that researchers at LeakedSource cracked at a rate of roughly 90 percent within three hours of obtaining the dataset. This made the credentials immediately usable. The dump quickly circulated across criminal forums, where attackers used the email-and-password pairs in credential-stuffing attacks targeting platforms including Gmail, PayPal, and Steam, and bundled them into phishing and spam toolkits. No major regulatory action has been publicly documented in connection with this breach. VK responded by forcing password resets for affected accounts. Affected individuals face lasting risk: even years after the fact, these credentials remain in active circulation on criminal networks. Anyone who used the same password on VK as on other services should treat those accounts as compromised and update them immediately.
ObscureIQ assessment: Severe risk of account takeover, harassment, phishing, and identity linkage. Social-graph and messaging data also support surveillance, stalking, and large-scale profiling.
Breach Impact
The 2012 breach exposed approximately 100 million accounts including names, phone numbers, email addresses, and plaintext passwords. The data did not surface publicly until 2016 when it appeared for sale on dark web markets. VK responded by forcing password resets for affected accounts. The use of plaintext password storage — rather than hashing — made the credentials immediately usable by anyone who obtained the dataset. The incident is cited as one of the larger social platform credential exposures of the 2010s alongside similar events at LinkedIn and MySpace.
About VKontakte
VKontakte, commonly known as VK, is Russia's largest social network and digital services platform. The company operates a broad suite of services including social networking, messaging, music streaming, video, gaming, and payments under the VK brand. It is headquartered in Saint Petersburg and is publicly listed on the Moscow Exchange. VK serves hundreds of millions of registered users, concentrated in Russia and Russian-speaking communities globally, and functions as a dominant internet platform across multiple content and communications categories.
Why They Hold Your Data
Social-media platforms collect user identity, contact details, messages, social graphs, posts, media uploads, behavioral signals, and account records across large communication ecosystems.
Recent Developments
VK has operated under sustained western sanctions and geopolitical pressure following Russia's invasion of Ukraine in 2022, limiting its partnerships and investment options in European and American markets. The company has continued expanding domestic Russian digital services and has been associated with compliance with Russian state data localization laws. International growth has effectively stalled. No major structural or ownership changes have been reported in the most recent period.
Data Points Exposed
4 verified field types
Email Address
Full Name High
Password Critical
Phone Number
Field names are shown in full for clarity and search visibility. Canonical machine keys are emitted only in this page’s structured data.
Exploitation & Downstream Threats
Threat Activity:High
Primary downstream threats:
- Credential stuffing against reused passwords across other platforms
- SIM swap attacks where phone numbers are present
- Targeted phishing campaigns using exposed email addresses
Threat vectors:
- Phishing, credential stuffing & account takeover
- Name-based social engineering
- Credential stuffing & account takeover
- SIM swapping, vishing & SMS phishing
Recommended Actions
If you believe your information may be included:
Change Reused Passwords
Update this account and anywhere you reused the password; use a manager.
Enable MFA Everywhere
Turn on multi-factor authentication on email first, then financial accounts.
Report & Recover
If you spot misuse, start an official recovery plan and report fraud.
Frequently Asked Questions
What happened in the VKontakte breach?▾
VKontakte, Russia's largest social network, suffered a credential-theft breach around late 2012 that exposed approximately 93 million user accounts. The intrusion went undetected for nearly four years before surfacing on 5 June 2016, when a hacker known as "Peace" listed the stolen data for sale on…
What data was exposed?▾
Verified fields include Email Address, Full Name, Password, Phone Number.
What should I do if I was affected?▾
Change reused passwords, enable MFA, and (if identity or financial data is involved) freeze your credit and monitor your accounts.
Sources & References
Every claim on this page is traceable. This breach draws on:
Breach Index
Breach Index
ObscureIQ Intelligence
ObscureIQ proprietary analysis
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation