Threat Intelligence · Privacy
Belarusian hacktivists claim breach of Moscow's healthcare network in 2023
Belarusian Cyber Partisans say they accessed the Moscow Department of Health's IT systems in 2023, confirming a recent Russian report. Sensitive medical data may have been exposed.
Ross Grant3 min read
The short version
A group of Belarusian activist hackers says they broke into Moscow's healthcare IT network in 2023. They claim they could access sensitive medical information but did not damage the systems. The breach was only recently reported by a Russian cybersecurity firm. It is not yet clear what specific data was taken or if patients have been notified.
What happened?
Belarusian hacktivists known as the Cyber Partisans have claimed responsibility for a 2023 breach of the Moscow Department of Health's IT network. The group says it gained administrator access and spent months inside the network before leaving. Sensitive medical data may have been accessed, but there is no evidence of data destruction or disruption. The claim follows a recent report by Russian cybersecurity firm Solar identifying the group as the likely perpetrator.
Who are the Cyber Partisans and what did they do?
The Belarusian Cyber Partisans, a group of activist hackers, have claimed responsibility for a breach of the Moscow Department of Health's IT network. According to a statement given to Recorded Future News (opens in a new tab), the group infiltrated the network in 2023. They say they quickly gained administrator-level access and could reach systems connected to other Russian government agencies. The group claims they spent several months inside the network before leaving, as the target was not a priority for them.
How was the breach discovered?
The admission from the Cyber Partisans came after a Russian cybersecurity firm, Solar (a subsidiary of Rostelecom), published a report last week. Solar had discovered the breach in December 2025 and traced the earliest signs to early 2024. This suggests the hackers may have had access for almost two years. The Cyber Partisans, however, say they entered the network a year before Solar's timeline and did not try to keep their access after finishing their objectives.
What was accessed and what could it mean?
Solar's report said the Moscow Department of Health operates a large IT network connected to many other healthcare institutions. This could have allowed the attackers to reach more systems and data. The Cyber Partisans confirmed they accessed sensitive medical information but did not destroy data or disrupt operations. They did not reveal exactly what data they took. However, they told Recorded Future News that medical information from such operations could be used to assess Russian military casualties in the war in Ukraine. The group said they could not disclose further details for operational reasons.
Who are the Cyber Partisans?
The Cyber Partisans formed after mass protests against Belarusian President Alexander Lukashenko in 2020. Since then, they have claimed responsibility for several cyberattacks on Belarusian government institutions and the railway system. After Russia invaded Ukraine in 2022, the group expanded its activities to target Russian organisations, focusing on intelligence gathering and disrupting infrastructure. In July, Russia's Supreme Court labelled the Cyber Partisans an "extremist organisation," accusing them of trying to destabilise both Russia and Belarus.
What happens next and what is still unclear?
At this stage, only one news outlet has reported the Cyber Partisans' admission. There is no independent confirmation from Russian authorities or the Moscow Department of Health. It is also not clear what specific information was accessed or if any patients have been notified. The Cyber Partisans claim to have access to hundreds of IT systems across Russia and Belarus, but this has not been independently verified.
What should organisations learn from this?
This incident highlights the risks of long-term, undetected access by motivated attackers. Healthcare networks, especially those connected to other institutions, are attractive targets for both intelligence and disruption. Organisations should review their detection and response capabilities and consider the risks of interconnected systems. Regular security assessments and monitoring for unusual activity are essential.
Claimed vs confirmed
- Confirmed
The Cyber Partisans gained administrator access to the Moscow Department of Health's IT network in 2023.
Confirmed by the Cyber Partisans in a statement to Recorded Future News.
- Confirmed
The group accessed sensitive medical information but did not destroy data or disrupt operations.
Both the Cyber Partisans and Russian firm Solar reported this.
- Unconfirmed
The Cyber Partisans currently have access to hundreds of IT systems across Russia and Belarus.
Claimed by the Cyber Partisans; not independently verified.
The impact
- Money
- No financial loss has been reported. However, under Russian law, breaches involving personal data can result in regulatory action. In other countries, fines for data breaches can reach millions.
- Reputation
- The breach could damage trust in the Moscow Department of Health and raise concerns about the security of Russian government systems, especially given the political context.
- Customers
- Patients' medical data may have been accessed. There is no evidence of data misuse or notification to affected individuals. Patients should be aware of the risks if more details emerge.
Why it matters
Healthcare networks hold sensitive personal and medical data. If attackers gain access, this information can be used for intelligence, blackmail, or to influence conflicts. Even if no data is destroyed, the privacy of patients and the security of national infrastructure are at risk. The incident also shows how political groups use cyberattacks as part of wider campaigns.
How does it work?
The group claims it gained administrator-level access to the Moscow Department of Health's IT infrastructure, which was connected to other government systems. The exact method used to gain access has not been disclosed. Once inside, they could move through the network and access sensitive data.
Key points
- Belarusian Cyber Partisans claim they breached Moscow's healthcare network in 2023.
- The group says it accessed sensitive medical data but did not disrupt operations.
- The breach was discovered by Russian firm Solar in December 2025.
- It is not clear what specific data was taken or if patients were notified.
- Healthcare networks remain attractive targets for politically motivated hackers.
Sources
Recorded Future News
Reference
