Russia's Cybersecurity Gap Widens as Data Breaches Hit 52 Million Records

Russia's 2025 Data Breach Tally: 118 Incidents, 52 Million Records Exposed

Russian companies are accelerating their digital transformation—rolling out new services, connecting applications and data, and embedding AI into workflows. But this expansion has a dark side: the more interconnected these systems become, the more vulnerable they are to cyberattacks. According to Roskomnadzor, Russia's communications regulator, 2025 saw 118 incidents involving compromised personal data databases, with more than 52 million records leaked into public view. That figure underscores how a single vulnerability—a misconfigured access right or an unprotected integration—can cascade across multiple business processes.

The response is shifting from reactive patching to proactive design. Companies are increasingly expected to build security into digital projects from the very beginning—when architecture is chosen, technologies are selected, and data-handling procedures are established. This approach, known as "Secure by Design," is now backed by a new regulatory framework: GOST R 72118-2025, which took effect in December 2025. The standard sets requirements and recommendations for development methodologies that treat security as a structural property of the system, not an afterthought.

For information security teams, this means a broader mandate. They must identify which assets are critical, construct realistic threat scenarios, collaborate closely with development teams, and verify that protective measures can withstand actual attack methods. For executives, the challenge is to assess potential damage, prioritize investments, and justify security spending in business terms. As Mikhail Shepelev, curator of the Information Security program at Academy AiTi, put it: "Architectural errors cannot be fixed by cyber exercises alone, and technical checks lose value if their results do not influence system development."

To meet this structural demand, Academy AiTi has launched a new course titled "Technologies in Information Security: Trends, Methodologies, Frameworks." The program focuses on threat assessment methodologies, secure-by-design principles, DevSecOps (integrating security into development), and MLSecOps (securing machine learning systems). A key emphasis is translating technical metrics into business language—estimating potential damage and calculating the effectiveness of protective measures—to cultivate managers who can bridge the gap between development, security, and business teams.

Why Secure-by-Design Is Becoming Russia's New Compliance Battleground

Why 52 Million Leaked Records Is a Business Problem, Not Just an IT Problem

The Roskomnadzor figures—118 incidents and 52 million records in a single year—represent more than a statistic. They signal a systemic vulnerability in how Russian organizations design and operate their digital infrastructure. The root cause is rarely a single sophisticated attack; more often it is architectural flaws, misconfigured access controls, or unprotected integrations that go unnoticed until exploited. As companies rush to deploy AI and interconnected services, the attack surface expands faster than defensive capabilities. This creates a direct commercial risk: a breach can disrupt operations, erode customer trust, and trigger regulatory scrutiny—all of which carry measurable financial costs.

The New GOST Standard: Compliance Burden or Competitive Advantage?

GOST R 72118-2025, effective December 2025, formalizes the secure-by-design approach. While the standard is advisory in nature, it signals a regulatory direction that companies ignore at their peril. For Russian businesses, compliance will require rethinking development lifecycles, from initial architecture through deployment. This is not merely a paperwork exercise; it demands that security professionals work alongside developers and business leaders to embed controls into the product itself. Early adopters may find that this approach reduces long-term remediation costs and improves resilience, while laggards risk both breaches and potential regulatory penalties.

Academy AiTi's Bet on a New Kind of Security Professional

Academy AiTi's new course targets a specific market gap: professionals who can operate at the intersection of information security, IT, and digital project management. The curriculum covers threat modeling, DevSecOps, and MLSecOps—recognizing that AI systems introduce novel vulnerabilities that traditional security frameworks do not address. The emphasis on translating technical metrics into business language is particularly telling. It reflects a broader shift in the security field: the most valuable professionals are no longer just those who can configure firewalls, but those who can quantify risk, justify budgets, and influence corporate strategy. For companies, this means that hiring and training priorities should evolve accordingly.

What This Means for Russian Businesses and the Security Workforce

In the short term (0–6 months), companies should expect increased demand for security expertise, potentially driving up salaries and competition for talent. The new GOST standard may also prompt a wave of compliance assessments. In the medium term (6–24 months), organizations that successfully integrate security into development workflows could gain a competitive edge—faster, more secure product launches and reduced incident response costs. Those that do not may face escalating breach-related expenses and reputational damage. Longer term (2–5 years), the market may see a consolidation of security and development roles, with a premium on professionals who can bridge both domains. The broader trend is clear: cybersecurity is transitioning from a back-office function to a core element of digital strategy.

What Russian Companies Must Do Before the Next Breach

The single most important insight: With 52 million records leaked in 2025 and a new secure-by-design standard in force, Russian companies can no longer treat cybersecurity as a post-development fix—it must be embedded from the first line of code.

For senior management at Russian companies, the implications are immediate and concrete:

• Conduct a secure-by-design audit (0–6 months): Review your current digital projects against GOST R 72118-2025 requirements. Identify architectural vulnerabilities and unprotected integrations before they are exploited.
• Invest in DevSecOps and MLSecOps training (0–6 months): Equip your development and security teams with the skills to integrate security into CI/CD pipelines and machine learning workflows. Academy AiTi's new course is one option, but internal upskilling is also viable.
• Translate security metrics into business language (6–24 months): Require your security team to present risk assessments in terms of potential financial damage and ROI of protective measures. This will help secure budget and executive buy-in.
• Prepare for regulatory scrutiny (6–24 months): Although GOST R 72118-2025 is not yet mandatory, Roskomnadzor's breach statistics increase the likelihood of stricter enforcement. Document your compliance efforts.
• Recruit hybrid professionals (2–5 years): Prioritize hiring or developing staff who can bridge security, development, and business strategy. These roles will become critical as AI adoption grows.

Metrics to watch: Roskomnadzor's next annual breach report (due late 2026), the number of companies certifying compliance with GOST R 72118-2025, and salary trends for DevSecOps and MLSecOps specialists in Russia.