Loading signal...
Signal
Submitted
May 2, 2026, 18:29 UTC
UpGuard secured a 1.7TB data leak exposing Russian telecom infrastructure details involving Nokia and Mobile TeleSystems (MTS), including sensitive SORM surveillance system materials.
UpGuard disclosed a significant data exposure incident involving 1.7 terabytes of sensitive information related to Russian telecommunications infrastructure, primarily affecting Nokia and Russia's largest telecom operator, Mobile TeleSystems (MTS). The exposed data included detailed schematics, administrative credentials, emails, installation photographs, and instructions for SORM, the surveillance system used by the FSB and Russian law enforcement agencies for lawful interception and communication monitoring across multiple cities in Russia, including Moscow. The data was found on a publicly accessible rsync server not hosted by Nokia but linked to a handover folder from a Nokia employee to a third party who failed to protect the data. The breach included inventories of hardware, emails, contracts, photos showing sensitive infrastructure, and administrative passwords, raising concerns about potential misuse including remote access and physical sabotage. Notification efforts began on September 9, 2019, culminating in Nokia securing the server by September 13. The incident underscores the risks of data exposures involving critical state surveillance infrastructure and highlights the inseparable nature of physical and information security. UpGuard’s findings highlight risks comparable to other major data breaches but unique given the national security implications of SORM system details disclosed.
Confidence: High
The article details a hostile data exposure of critical Russian telecom and surveillance infrastructure involving SORM, indicating aggressor-level compromise and espionage risks.
Source URL
https://upguard.com/breaches/mts-nokia-telecom-inventory-data-exposure
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "8780440b-f0be-473f-8d56-d7e70247ecba",
"url": "https://upguard.com/breaches/mts-nokia-telecom-inventory-data-exposure",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Unknown",
"incident_type": "Unknown",
"country": "Russian Federation",
"source_reliability": "A",
"info_credibility": "3",
"tags": [
"finland",
"russia",
"sorm",
"nokia",
"data leak",
"telecommunications",
"mts",
"surveillance",
"offensive cyber operations",
"lawful interception",
"infrastructure exposure"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [
"Russian Federation"
],
"where_text": "Cyberspace",
"headline": "Telecommunications Breakdown: How Russian Telco Infrastructure was Exposed",
"description": "A storage device containing 1.7 terabytes of telecommunications infrastructure data related to Russian entities Nokia and Mobile TeleSystems (MTS) was exposed on a publicly accessible rsync server. The dataset encompassed schematics, administrative credentials, email archives, photographs, project files, and detailed installation documents related to SORM—the Russian lawful intercept system used by the FSB. This exposure detailed recent generation hardware deployed across at least 16 Russian cities plus Moscow. Nokia confirmed the data originated from a hand-over folder mishandled by a third party. The breach revealed detailed architectural diagrams, passwords, subcontractor information, signed contracts, and thousands of photographs showing equipment with serial numbers and locations. Despite notification attempts starting September 9, 2019, Nokia only secured the server after several days and intervention by U.S. government regulators. The incident exposed highly sensitive national surveillance infrastructure details with potential for adversaries to gain remote access or plan physical sabotage.",
"summary_short": "UpGuard secured a 1.7TB data leak exposing Russian telecom infrastructure details involving Nokia and Mobile TeleSystems (MTS), including sensitive SORM surveillance system materials.",
"summary_extended": "UpGuard disclosed a significant data exposure incident involving 1.7 terabytes of sensitive information related to Russian telecommunications infrastructure, primarily affecting Nokia and Russia's largest telecom operator, Mobile TeleSystems (MTS). The exposed data included detailed schematics, administrative credentials, emails, installation photographs, and instructions for SORM, the surveillance system used by the FSB and Russian law enforcement agencies for lawful interception and communication monitoring across multiple cities in Russia, including Moscow. The data was found on a publicly accessible rsync server not hosted by Nokia but linked to a handover folder from a Nokia employee to a third party who failed to protect the data. The breach included inventories of hardware, emails, contracts, photos showing sensitive infrastructure, and administrative passwords, raising concerns about potential misuse including remote access and physical sabotage. Notification efforts began on September 9, 2019, culminating in Nokia securing the server by September 13. The incident underscores the risks of data exposures involving critical state surveillance infrastructure and highlights the inseparable nature of physical and information security. UpGuard’s findings highlight risks comparable to other major data breaches but unique given the national security implications of SORM system details disclosed.",
"actor_primary": "Unnamed third party",
"target_primary": null,
"location_text": "Moscow",
"location_region": null,
"location_coordinates_lat": 55.7558,
"location_coordinates_lon": 37.6173,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article details a hostile data exposure of critical Russian telecom and surveillance infrastructure involving SORM, indicating aggressor-level compromise and espionage risks.",
"event_time_utc": "2019-09-09T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-05-02T18:29:00.160Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
A
Info credibility
3
Event time
Sep 9, 2019, 00:00 UTC
Event time confidence
pm24h
Location
Moscow
Primary actor
Unnamed third party
Country
Russian Federation
Countries
Russian Federation
Tags
finland, russia, sorm, nokia, data leak, telecommunications, mts, surveillance, offensive cyber operations, lawful interception, infrastructure exposure
Nodes
Node 2: 5th Column
Signal
Submitted
May 2, 2026, 18:29 UTC
UpGuard secured a 1.7TB data leak exposing Russian telecom infrastructure details involving Nokia and Mobile TeleSystems (MTS), including sensitive SORM surveillance system materials.
UpGuard disclosed a significant data exposure incident involving 1.7 terabytes of sensitive information related to Russian telecommunications infrastructure, primarily affecting Nokia and Russia's largest telecom operator, Mobile TeleSystems (MTS). The exposed data included detailed schematics, administrative credentials, emails, installation photographs, and instructions for SORM, the surveillance system used by the FSB and Russian law enforcement agencies for lawful interception and communication monitoring across multiple cities in Russia, including Moscow. The data was found on a publicly accessible rsync server not hosted by Nokia but linked to a handover folder from a Nokia employee to a third party who failed to protect the data. The breach included inventories of hardware, emails, contracts, photos showing sensitive infrastructure, and administrative passwords, raising concerns about potential misuse including remote access and physical sabotage. Notification efforts began on September 9, 2019, culminating in Nokia securing the server by September 13. The incident underscores the risks of data exposures involving critical state surveillance infrastructure and highlights the inseparable nature of physical and information security. UpGuard’s findings highlight risks comparable to other major data breaches but unique given the national security implications of SORM system details disclosed.
Confidence: High
The article details a hostile data exposure of critical Russian telecom and surveillance infrastructure involving SORM, indicating aggressor-level compromise and espionage risks.
Source URL
https://upguard.com/breaches/mts-nokia-telecom-inventory-data-exposure
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "8780440b-f0be-473f-8d56-d7e70247ecba",
"url": "https://upguard.com/breaches/mts-nokia-telecom-inventory-data-exposure",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Unknown",
"incident_type": "Unknown",
"country": "Russian Federation",
"source_reliability": "A",
"info_credibility": "3",
"tags": [
"finland",
"russia",
"sorm",
"nokia",
"data leak",
"telecommunications",
"mts",
"surveillance",
"offensive cyber operations",
"lawful interception",
"infrastructure exposure"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [
"Russian Federation"
],
"where_text": "Cyberspace",
"headline": "Telecommunications Breakdown: How Russian Telco Infrastructure was Exposed",
"description": "A storage device containing 1.7 terabytes of telecommunications infrastructure data related to Russian entities Nokia and Mobile TeleSystems (MTS) was exposed on a publicly accessible rsync server. The dataset encompassed schematics, administrative credentials, email archives, photographs, project files, and detailed installation documents related to SORM—the Russian lawful intercept system used by the FSB. This exposure detailed recent generation hardware deployed across at least 16 Russian cities plus Moscow. Nokia confirmed the data originated from a hand-over folder mishandled by a third party. The breach revealed detailed architectural diagrams, passwords, subcontractor information, signed contracts, and thousands of photographs showing equipment with serial numbers and locations. Despite notification attempts starting September 9, 2019, Nokia only secured the server after several days and intervention by U.S. government regulators. The incident exposed highly sensitive national surveillance infrastructure details with potential for adversaries to gain remote access or plan physical sabotage.",
"summary_short": "UpGuard secured a 1.7TB data leak exposing Russian telecom infrastructure details involving Nokia and Mobile TeleSystems (MTS), including sensitive SORM surveillance system materials.",
"summary_extended": "UpGuard disclosed a significant data exposure incident involving 1.7 terabytes of sensitive information related to Russian telecommunications infrastructure, primarily affecting Nokia and Russia's largest telecom operator, Mobile TeleSystems (MTS). The exposed data included detailed schematics, administrative credentials, emails, installation photographs, and instructions for SORM, the surveillance system used by the FSB and Russian law enforcement agencies for lawful interception and communication monitoring across multiple cities in Russia, including Moscow. The data was found on a publicly accessible rsync server not hosted by Nokia but linked to a handover folder from a Nokia employee to a third party who failed to protect the data. The breach included inventories of hardware, emails, contracts, photos showing sensitive infrastructure, and administrative passwords, raising concerns about potential misuse including remote access and physical sabotage. Notification efforts began on September 9, 2019, culminating in Nokia securing the server by September 13. The incident underscores the risks of data exposures involving critical state surveillance infrastructure and highlights the inseparable nature of physical and information security. UpGuard’s findings highlight risks comparable to other major data breaches but unique given the national security implications of SORM system details disclosed.",
"actor_primary": "Unnamed third party",
"target_primary": null,
"location_text": "Moscow",
"location_region": null,
"location_coordinates_lat": 55.7558,
"location_coordinates_lon": 37.6173,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article details a hostile data exposure of critical Russian telecom and surveillance infrastructure involving SORM, indicating aggressor-level compromise and espionage risks.",
"event_time_utc": "2019-09-09T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-05-02T18:29:00.160Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
A
Info credibility
3
Event time
Sep 9, 2019, 00:00 UTC
Event time confidence
pm24h
Location
Moscow
Primary actor
Unnamed third party
Country
Russian Federation
Countries
Russian Federation
Tags
finland, russia, sorm, nokia, data leak, telecommunications, mts, surveillance, offensive cyber operations, lawful interception, infrastructure exposure
Nodes
Node 2: 5th Column