In short: Russian cybercriminals have added a new lever to their extortion toolkit: after breaching a company and stealing personal data, they skip the public leak dump and instead demand a ransom under threat of self-reporting the incident to Roskomnadzor. Russia's 420-FZ turnover fines — up to 3% of annual revenue, minimum 25 million rubles — have become a weapon aimed at the very companies they were designed to protect. The finding comes from a September 2026 study by UCSB (Ural Centre for Security Systems), as reported by www1.ru.
What changed and why it matters
In May 2025, Federal Law No. 420-FZ on turnover fines for personal data violations came into force in Russia. Before that, the maximum penalty for a data breach was 100,000–300,000 rubles regardless of scale — an amount large companies typically absorbed as an operating cost. The new law calculates repeat-violation fines as a share of revenue: 0.1% to 3% of annual turnover, with a floor of 25 million rubles. For a mid-sized company, that is a number that can genuinely threaten financial stability — which is why threats of this kind are increasingly covered in the LiMP VPN privacy blog.
Cybercriminals adapted faster than many security executives could update their threat models. The old script was straightforward: encrypt data, demand a ransom for the decryption key. The new script adds a regulatory track: "Pay us, or we will report the breach to Roskomnadzor ourselves and provide evidence." The threat of a fine measured in tens or hundreds of millions of rubles can be more frightening than the immediate loss from an IT outage.
How the scheme works in practice
According to the Ural Centre for Security Systems (UCSB), 2026 attacks have become increasingly layered. Stage one is penetration — typically via a phishing email to an employee or an attack on a contractor with corporate network access. Stage two is data exfiltration: corporate communications, backups, customer databases, and source code are copied out. Stage three is ransomware encryption, locking the company out of its own systems. A DDoS attack is sometimes used as a distraction during stage two.
The extortion demand then comes in two parts. The first is classic: a ransom for the decryption key. The second is new: "We have proof of the breach. Pay up, or we report you to the regulator ourselves and submit screenshots as evidence." A key legal detail makes this credible: Russian law requires companies to notify Roskomnadzor of a personal data breach within 24 hours of discovery. Missing that window, or concealing an incident, is itself a separate violation. Criminals are turning this legal obligation into a pressure point.
Artificial intelligence is accelerating the initial compromise: neural-network tools now generate convincing personalised phishing emails at scale, slashing the cost of that first credential theft — the door into the rest of the attack chain.
The numbers: threat outsizes reality
The 2026 data shows a striking paradox. Over 18 months of the new law, 52 administrative investigations were opened, yet the total fines actually imposed came to roughly 2.6 million rubles — against an estimated 1.581 billion user records compromised in 2025 alone. The law's bark has been far louder than its bite.
Yet corporate behaviour changed substantially. Companies began building information-security budgets around expected penalties rather than realised fines. The threat of punishment reshaped the economics of security decisions more than actual enforcement did. That asymmetry is exactly what extortionists exploit: the real regulatory fine might never arrive, but the demand backed by the threat of a self-report works today.
The pattern of leaks also shifted: publicly disclosed breaches dropped by roughly 75%, while activity on dark-web trading forums rose by nearly 60%. Data is not disappearing — it is simply being sold quietly. For users, that means a breach may never surface publicly; the stolen records travel in the shadows until they appear as targeted phishing, scam calls, or unexpected account-login alerts months later.
What this means for your privacy
The scheme has direct consequences for people whose data sits in attacked companies. While ransom negotiations are under way, personal information — names, phone numbers, emails, transaction history, passport data — is already in criminal hands. The outcome of those negotiations does not change that fact: even if a company pays, the stolen data remains with the attackers. And because it is sold quietly, you may never learn your records were compromised — until they resurface in targeted phishing or an unexpected login attempt on your accounts.
Security specialists therefore advise not to assume the services you use will protect your data better than you can protect yourself. Use a unique password for every service — a leak from one platform then cannot open accounts elsewhere. Regularly check whether your email address appears in known breach databases. Minimise the personal data you share with online services: the less data stored, the lower the impact of any future incident.
Practical steps to reduce your risk
Start with a password manager and two-factor authentication. The most common entry point in these attacks is a phishing email that harvests one employee's or user's credentials. A unique password and a second factor mean two independent barriers an attacker must bypass, not one. Apply the same discipline to your personal accounts: banking, email, and primary app stores all deserve 2FA.
At the network layer, attackers often harvest credentials on public Wi-Fi — in cafés, airports, and hotels. Encrypting your traffic with a reliable VPN protocol closes that vector. The LiMP VPN app encrypts all connections and operates under a strict no-logs policy, so neither your internet provider nor the service itself retains a record of your activity. See the features and plans. One important caveat: a VPN secures data in transit; it does not replace timely software updates, strong passwords, or caution with email attachments — those remain separate, complementary layers of defence.