What data was compromised in the Kassy.ru breach?

The breach exposed over 300,000 user accounts containing user IDs, passwords, Telegram IDs and usernames, email addresses with confirmation status, phone numbers, personal details (name, patronymic, sex, birthday), geographic data (city, locale), delivery information, payment system data including transaction records, receipt IDs, booking information, and approval codes.

When did the Kassy.ru breach occur?

The breach occurred in December 2025. The threat actor posted the database for download on December 29, 2025.

Who is responsible for the Kassy.ru breach?

The threat actor 'Demetrius' leaked the database on DarkForums, providing download links and sample data.

Kassy.ru is a Russian city entertainment ticketing service that sells tickets to events across over 100 Russian cities.

What should affected users do?

Users should immediately change passwords on Kassy.ru and any other services using the same credentials, monitor payment cards for unauthorized transactions, watch for phishing attempts using their exposed contact information, and enable two-factor authentication where available.

How many incidents has Demetrius been involved in?

The Demetrius threat actor has been linked to at least 21 incidents since September 2025, targeting organizations across Saudi Arabia, USA, Iran, India, and Russia in sports, wholesale, IT services, events services, and e-commerce sectors.

Russian Ticketing Platform Kassy.ru Database Breach Exposes 300K User Records

API Access for Researchers & Security Teams

SOC teams, researchers, and security professionals can integrate Dark Web Informer's threat intelligence directly into their workflows via API. Access real-time breach data, threat feeds, and monitoring capabilities programmatically.

Learn About API Access

Disclaimer

This breach alert includes material that may contain personally identifiable information (PII) gathered strictly from publicly available sources. All information is provided solely for cybersecurity awareness and threat intelligence purposes.