unique insights into one of the biggest russian financial institutions

after taking a two month long hiatus (for mental health reasons, nothing to get into deeper here), i decided catch up again with some sources a few weeks ago. one of them started bringing up some massive hacks they had been doing in russia, making it clear they had financial motivations and planned on selling the data rather than leaking it publicly. this of course immediately piqued my interest and i tried to find a way to make a story happen anyways and after a bit of discussion we ended up striking a deal, i get exclusive access to the data for this piece but won’t share it any further and they still get to sell it.

the target

rosgosstrakh (RGSL/росгосстрах) is the second biggest russian insurance company, behind SOGAZ with an annual revenue of around 90 billion rubles (2022). RGSL has been subject to US sanctions since the start of the russian invasion of ukraine in february 2022. my source gained full access to their investment and life insurance department with data going back to 2010, giving them full access to ~3 million bank statements, data on 730k people/holders (around 80k of which with SNILS (russian ssn) and another 45k with full bank routing info), and all life insurance policies/contracts. they are also able to access all attachments to the former data, such as passports and scanned documents (i was only provided with a small selection of this data, but all of it is included in the purchasable dataset). the source further claims that they most likely have the ability to authorize and create bank transfers if they wanted to do so.

two screenshots of the adinsure software used by RGS captured by the hackers during the attack

analysis

with access to an overwhelming 22gbs of plain json data i did what i always do when i get big datasets like this and first try to find interesting organizations or persons. in this case this was especially easy – public officials (or their direct relatives/spouses) are marked with "isPublicOfficial": true, making them super quick to find. i did this (and all my other searches) the lazy way, just searching over the directory with ripgrep rather than indexing the data to a database, but it worked, finding a number of customers marked as public officials (it is highly likely there are way more officials in the dataset left unmarked due to how RGS’s system is designed). it was now just a matter of using OSINT to link the provided data to existing people. the table below includes everyone out of those i was conclusively able to identify, with the data from this dataset and any publicly findable info to complete the picture.