VKontakte 2024 Data Breach
Platform · Social networking, messaging, and community media sharing · Social network · Russia
VK (VKontakte) Russian Social Network Breach (2024): 369 Million User Full Names Exposed by HikkI-Chan
Russian social network and digital services platform
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
25/100
Lower riskHigher risk
Lower: limited current risk based on data value and recency.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
369.3MRecords
2024Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Breach Summary
VKontakte (VK), Russia's largest social network, had personal data belonging to over 369 million users exposed in September 2024 when a threat actor known as HikkI-Chan published a 27.6 GB dataset online. The breach pathway was not a system intrusion. Instead, the data appears to have been harvested through automated web scraping, a technique that collects information already visible on public-facing profile pages. VK denied that any security breach had occurred, stating that no confidential information had been accessed and that its internal systems remained intact. The exposed data consisted of users' full names linked to their VK accounts. While names alone may appear low-risk, at a scale of 369 million records they become a meaningful asset for profiling. Attackers can cross-reference names against other leaked datasets to build richer profiles, identify individuals across platforms, or target them with phishing attempts and harassment. The sheer volume of the dataset amplifies these risks considerably. VK has not issued detailed public statements confirming the incident or describing a formal response. Because VK operates under Russian jurisdiction, Western breach notification frameworks do not apply, and there is no documented regulatory action. The dataset was independently verified by security researchers and added to Have I Been Pwned, giving affected users one avenue to check their exposure. People whose names appear in the dataset should be alert to unsolicited contact, suspicious login attempts, and any messages that reference personal details they did not knowingly share.
Full threat analysis, exploitation vectors, and principal guidance below.
11 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
369.3M records analyzed
About VKontakte
VKontakte, commonly known as VK, is Russia's largest social network and digital services platform. The company operates a broad suite of services including social networking, messaging, music streaming, video, gaming, and payments under the VK brand. It is headquartered in Saint Petersburg and is publicly listed on the Moscow Exchange. VK serves hundreds of millions of registered users, concentrated in Russia and Russian-speaking communities globally, and functions as a dominant internet platform across multiple content and communications categories.
Why They Hold Your Data
Social-network platforms collect user identity, contact details, messages, social graphs, posts, media uploads, and engagement records tied to messaging and social-media workflows.
Recent Developments
VK has operated under sustained western sanctions and geopolitical pressure following Russia's invasion of Ukraine in 2022, limiting its partnerships and investment options in European and American markets. The company has continued expanding domestic Russian digital services and has been associated with compliance with Russian state data localization laws. International growth has effectively stalled. No major structural or ownership changes have been reported in the most recent period.
Data Points Exposed
1 verified field types
Full Name
Breach Impact
In September 2024 a threat actor known as HikkI-Chan claimed to have exfiltrated over 370 million user records, publishing a 27.6GB dataset. The exposed data contained full names linked to VK accounts. VK has not made detailed public statements confirming the breach or outlining its response. The incident was added to Have I Been Pwned based on external researcher verification of the dataset. Given VK's operating environment and Russia's regulatory landscape, formal breach notification obligations under western frameworks do not apply, and documented organizational consequences remain limited in publicly available sources.
Exploitation & Downstream Threats
• Targeted phishing using exposed personal information | • Credential reuse attacks across linked accounts
Principal Risk Advisory
What this means for a principal
A social-platform breach: profile and contact-graph data supports impersonation, enrichment and social engineering. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
H
Threat Actor: HikkI-ChanConfidence: Low
Motivation: Unknown
An unvalidated alias without enough reliable public sourcing for a stable threat actor profile. It should be tied to specific marketplace posts, Telegram claims, or incidents before inclusion in a finished actor set.
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation