Dark Web Informer — Cyber Threat Intelligence
Threat Actor Claims Sale of 13.6 Million Records from Russian EdTech Platform Foxford
Russia
Quick Facts
Date & Time
2026-02-16 11:52:19 UTC
Threat Actor
Angel_Batista
Victim Country
RussiaIndustry
Education
Victim Organization
Foxford
Victim Site
Category
Data Breach
Severity
🟡 Medium
Network
Tor
Victim Profile
Foxford (Фоксфорд)
Leading Russian online education platform for K-12 students with 7.5M+ users Organization
Foxford (part of Netology Group)
Sector Type
Private
Industry
Education / E-Learning
Country
Russia Location
Moscow, Russia
Employees
1,300+ full-time, 2,500+ freelancers
Founded
2009
Website
Description
Foxford (Фоксфорд — Онлайн-школа) is one of Russia's largest online educational platforms, established in 2009 and serving K-12 students with tutoring, exam preparation (EGE/OGE), olympiad training, and home schooling programs. The platform is part of Netology Group and is a Skolkovo resident company, ranked among the top 3 largest EdTech companies in the Russian children's education market. Foxford reports over 7.5 million users and 2.5 million unique monthly visitors, offering courses crafted by educators from leading Russian universities including MSU, MIPT, and HSE.
Incident Overview
A threat actor using the handle "Angel_Batista" has posted a listing claiming to sell the databases of Foxford.ru, one of Russia's largest online education platforms for K-12 students. The breach allegedly impacts approximately 13.6 million customers, making it one of the larger education sector breaches reported this year.
