{
	"id": "cc633801-8913-4c39-a863-5eae461288c6",
	"created_at": "2026-04-06T00:11:16.547754Z",
	"updated_at": "2026-04-10T03:30:41.326155Z",
	"deleted_at": null,
	"sha1_hash": "0dd80fb2ffa694424004fcca67a2551d662bdafd",
	"title": "Ukrainian hackers claim breach of Russian loan company linked to Putin’s ex-wife",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 77832,
	"plain_text": "Ukrainian hackers claim breach of Russian loan company linked to\r\nPutin’s ex-wife\r\nBy Daryna Antoniuk\r\nPublished: 2025-02-21 · Archived: 2026-04-02 11:24:45 UTC\r\nThe pro-Ukraine hacking group Cyber Alliance has claimed responsibility for a cyberattack on CarMoney, a\r\nRussian microfinance company linked to the former wife of President Vladimir Putin. \r\nCarMoney confirmed earlier this week that it had suffered a cyber incident, forcing it to shut down all systems\r\nafter attackers sent spam messages to customers claiming the company was closing its business, donating its\r\nproceeds to charity and writing off all debts. The organization has not attributed the attack to Ukrainian hackers or\r\ndisclosed the full extent of the breach.\r\nCarMoney, one of Russia’s largest microfinance firms, issues short-term loans secured by vehicles. According to\r\nindependent Russian media, Putin’s ex-wife, Lyudmila Ocheretnaya, controls the company through a network of\r\noffshore entities.\r\nThe hackers said their attack destroyed CarMoney’s infrastructure and compromised “terabytes of data.”\r\nWhile CarMoney has assured clients and investors that no personal data was affected, the hackers claim they\r\nobtained information on a large number of borrowers, including members of Russian military units and\r\nintelligence officers.\r\nThe hackers shared screenshots on Telegram but the data’s  authenticity could not be independently verified.\r\nWhile CarMoney’s website remains operational, customers have reported ongoing payment service disruptions\r\nand difficulties accessing their accounts.\r\nCarMoney has said it will waive late fees, refrain from reporting delays to credit bureaus and introduce a bonus\r\nprogram once its systems are restored.\r\nThe Ukrainian Cyber Alliance, a community of pro-Ukraine cyber activists formed in 2016, has targeted Russian\r\nentities since the invasion of Ukraine nearly three years ago. \r\nEarlier in January, the Ukrainian Cyber Alliance claimed the attack on the Russian internet provider Nodex. The\r\ncompany confirmed that the incident “destroyed” its infrastructure and affected connectivity for both fixed-line\r\nand mobile services.\r\nLast October, the group claimed responsibility for disrupting parking enforcement in the Russian city of Tver. The\r\nyear before, the hackers claimed to have breached Russia's national card payment system and obtained user data.\r\nhttps://therecord.media/russia-carmoney-data-breach-ukrainian-cyber-alliance\r\nPage 1 of 2\n\nDaryna Antoniuk\r\nis a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in\r\nEastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for\r\nForbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.\r\nSource: https://therecord.media/russia-carmoney-data-breach-ukrainian-cyber-alliance\r\nhttps://therecord.media/russia-carmoney-data-breach-ukrainian-cyber-alliance\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia"
	],
	"references": [
		"https://therecord.media/russia-carmoney-data-breach-ukrainian-cyber-alliance"
	],
	"report_names": [
		"russia-carmoney-data-breach-ukrainian-cyber-alliance"
	],
	"threat_actors": [
		{
			"id": "4a73cb62-be05-49d2-9dbb-1298606ec0a3",
			"created_at": "2025-03-07T02:00:03.799095Z",
			"updated_at": "2026-04-10T02:00:03.827106Z",
			"deleted_at": null,
			"main_name": "Ukrainian Cyber Alliance",
			"aliases": [
				"UCA"
			],
			"source_name": "MISPGALAXY:Ukrainian Cyber Alliance",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "98cd3bc4-fd41-4087-be03-f6f8f3be7b67",
			"created_at": "2025-05-29T02:00:03.220566Z",
			"updated_at": "2026-04-10T02:00:03.871851Z",
			"deleted_at": null,
			"main_name": "Cyber Alliance",
			"aliases": [],
			"source_name": "MISPGALAXY:Cyber Alliance",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434276,
	"ts_updated_at": 1775791841,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/0dd80fb2ffa694424004fcca67a2551d662bdafd.pdf",
		"text": "https://archive.orkl.eu/0dd80fb2ffa694424004fcca67a2551d662bdafd.txt",
		"img": "https://archive.orkl.eu/0dd80fb2ffa694424004fcca67a2551d662bdafd.jpg"
	}
}