AtlasBus.ru Database Leak Exposes 98M+ User Records

Data Breach Summary

In May 2025, a massive breach exposed data from AtlasBus.ru, a Russian service for purchasing and booking tickets. The leak, published by user namolesa on darkforums.st, contained 6.09GB of sensitive information, impacting over 98 million records.

The leaked dataset included phone numbers linked to locations, user logins, hashed passwords, full names, emails, VK profiles, and city details. This breach highlights the risks associated with centralized transportation platforms storing large amounts of personal and contact data without adequate protection.

---

Where and How?

The breach was found on darkforums.st, posted by namolesa as a CSV dump of AtlasBus.ru’s user database. Data categories include:

• Locations + Phone Numbers: ~92.5M records containing IDs, criteria, phone or vehicle numbers, and dates.
• Registered Users: ~1.4M with login, hashed password, first/last name, email, phone, VK profile, and city.
• User Index: ~1.4M containing similar user details.
• Unregistered Users: ~1.9M with first/last names and phone numbers.
• Email Feedback: ~1.6M containing email addresses and dates.

The scale and content of this leak make it highly valuable for cybercriminals conducting phishing, smishing, or social engineering attacks.

Company Data Breach History

As of now, there is no known history of prior data breaches involving AtlasBus.ru. This incident highlights a potential gap in their security posture and the need for stronger protection of user data to avoid future leaks of this scale.

---

Further Action

AtlasBus.ru should investigate the breach urgently, identify and patch any vulnerabilities exploited, and communicate transparently with affected users about what data was exposed and how they can protect themselves.

---

Recommendations for Personal Data Protection

How Users Can Protect Their Information:

• Change passwords immediately, using strong combinations of letters, numbers, and symbols.
• Do not reuse passwords across accounts.
• Enable two-factor authentication whenever available.
• Be cautious of suspicious emails, SMS, or calls requesting personal information.
• Monitor accounts regularly for unusual activity.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.