Russia — 2026-09-18

Hackers Breach Russia Central Election Commission Systems Days Before State Duma Elections

BLUFCikLeak's breach targets legitimacy rather than operations, making confirmed disruption or manipulation of State Duma voting systems very unlikely through the close of voting on September 20, though the leak forces Moscow into a defensive posture on election day.

An anonymous hacking group calling itself CikLeak claimed it breached the IT infrastructure of Russia's Central Election Commission and contractors developing the Vybory 2.0 election platform, including Rostelecom subsidiary Tsifrotekh 12. The group said it downloaded internal documents, source code, server configurations, passwords, call recordings, and employee communications, and provided the material to investigative outlet IStories, which said it authenticated the documents 12. CikLeak stated it did not intend to disrupt voting and urged Russians to vote in person on the final day of the election, September 20 1. The claimed breach followed CEC Chair Ella Pamfilova's statement hours earlier that the commission had assessed vulnerabilities in the Vybory portal, remote voting system, and video surveillance infrastructure, identifying the video monitoring feed as a "weak link" 12. Tsifrotekh director Alexey Gusev told IStories he was unaware of the breach when contacted 2.

Analysis
The breach carries limited operational risk but forces the Kremlin into a public-trust defense through the close of voting, since CikLeak explicitly disclaimed intent to disrupt balloting and the exfiltrated material concerns administrative systems rather than the Vybory 2.0 vote-counting core. Confirmed disruption or manipulation of voting or tabulation tied to the breach is very unlikely through the close of voting on September 20. This judgment carries low confidence, reflecting reliance on a single primary evidentiary chain: IStories' authentication of the leaked material, with Kyiv Post, Meduza, and NV republishing without independent verification, and no independent technical forensics on system depth. CikLeak's call for Russians to vote in person suggests the operation targets delegitimization through information effects rather than infrastructure compromise, and Pamfilova's same-day admission of a video-monitoring "weak link" narrows the credible attack surface while keeping official messaging on the defensive. Absent confirmed disruption, the episode remains a messaging and counterintelligence matter rather than grounds for Western governments to revise Vybory 2.0 integrity assessments.

5 sources

Hackers claim breach of Russian election systems days before parliamentary vote - The Record (Recorded Future News)
Days before Russia's State Duma elections, hackers say they accessed the election commission's IT systems and downloaded server configurations and internal documents - Meduza
Hackers Breach Russia Invulnerable Voting System Ahead of State Duma Elections - Kyiv Post
Hackers claim breach of Russian election systems days before State Duma vote - NV (Novoye Vremya)
Хакеры взломали инфраструктуру ЦИК и его подрядчиков (Hackers breached the infrastructure of the Central Election Commission and its contractors) - IStories (Important Stories / Важные истории)