Reuters: Russian Hackers Breach Over 170 Email Accounts of Ukrainian Prosecutors and Investigators

Russian hackers have hacked more than 170 email accounts belonging to Ukrainian prosecutors and investigators in recent months.

The espionage campaign targeted officials responsible for fighting corruption and uncovering Russian collaborators, according to Reuters.

Dozens of officials in Romania, Greece, Bulgaria, and Serbia were also affected.

The hackers themselves accidentally exposed evidence of the cyberattacks. The leak was discovered by a group of British and American cybersecurity researchers known as Ctrl-Alt-Intel.

On one of the servers, experts found logs of successful operations and thousands of stolen emails. Analysis of the data indicates that at least 284 email accounts were compromised between September 2024 and March 2026.

Journalists note that most of the victims are in Ukraine, but some targets were also identified in neighboring NATO countries and the Balkans.

Ctrl-Alt-Intel stated that the hackers made a mistake during the breach, which allowed researchers to closely analyze how the Russian espionage network operates.

Targets included the Specialized Defense Prosecutor’s Office, the Asset Recovery and Management Agency (ARMA), and the Prosecutors’ Training Center in Kyiv, where around 44 email accounts were compromised.

The victims include Yaroslava Maksymenko, who at the time headed ARMA, as well as Oleh Duka, Deputy Director of the Prosecutors’ Training Center.

The attackers also breached at least one account belonging to a senior official at the Specialized Anti-Corruption Prosecutor’s Office.

Experts note that the espionage campaign is likely linked to Russian intelligence services. They suspect the involvement of the hacking group known as Fancy Bear, although this has not been officially confirmed.

Keir Giles, a researcher at the London-based think tank Chatham House, shared that the attackers likely targeted Ukrainian law enforcement to stay one step ahead of investigations into Russian spies or to gather potentially compromising information on senior officials in Kyiv.