All Breaches
September 8, 2021 Unverified Education

SchoolMos Alleged Data Exposure

The 2021 SchoolMos data breach occurred in September 2021 when internal student, parent, and teacher databases of the Moscow Electronic School (MES / МЭШ - school.mos.ru), administered by the Moscow Department of Education, were breached and leaked online.

3.3 Million
Email Identifiers
6
Data Types
Critical
Exposure Scope
Oct 10, 2026
Last updated

Protect Yourself

Check whether you were affected by this breach

Check my email

Exposed Data Types

6
  • Email addresses
  • Names
  • Phone numbers
  • Dates of birth
  • Government issued IDs
  • Usernames

About This Record

What information was compromised in the SchoolMos incident?

The leaked database export (school.mos.ru.csv) contains over 17 million educational and administrative profiles. Verified exposed data classes include:

  • Identity & Contact Details: Full Russian names (last, first, middle), system usernames, verified email addresses, and phone numbers.
  • Government-Issued Identifiers: SNILS numbers (Individual Insurance Account Numbers, equivalent to Russian Social Security Numbers).
  • Demographic Records: Dates of birth, gender, birth place, and citizenship status.
  • Administrative Metadata: Unique student/teacher GUIDs, system creation and update timestamps.

How many accounts were affected?

Standardized RFC 5322 ASCII canonical verification and RFC 2606 placeholder elimination (stripping 2.38M auto-generated dummy example.com accounts) confirmed 3,319,879 unique valid real-user email addresses.

Security advisory & personal identity protection

The combination of government SNILS identifiers with birth dates and phone numbers poses severe identity theft and spear-phishing risks. Impacted users should:

  • Enable two-factor authentication (2FA) on municipal and state portal accounts (such as Gosuslugi and mos.ru).
  • Remain vigilant against unsolicited phone calls or messages claiming to represent government or educational departments.

Verification and editorial method

LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.

Report missing or incorrect information