Hacked Crimean servers reveal information about abducted children, Ukraine says

Ukraine’s military intelligence agency said it hacked into government servers in Russian-occupied Crimea that allegedly contained evidence of Russia’s forced deportation of Ukrainian children from occupied territories.

The agency, known as HUR, said last week it obtained thousands of files identifying abducted Ukrainian children. These include personal information about those left without guardians, documents appointing Russian citizens as their new legal guardians, and addresses of locations where the children were relocated.

The data was shared with Ukrainian law enforcement for review and inclusion in ongoing criminal proceedings, HUR spokesperson Andriy Yusov said.

 “This information will help us find and bring the kidnapped children back to Ukraine, and hold those responsible accountable,” he said in a statement.

Nearly 20,000 Ukrainian children are confirmed to have been forcibly taken to Russia or Russian-occupied territories since the start of the war, according to Ukraine’s official Children of War database. Officials warn the actual number may be significantly higher.

HUR did not specify which servers were targeted, but documents shared by Ukraine’s military intelligence as evidence of the breach appear to come from the local government authority in the Simferopol district — part of the Crimean peninsula annexed by Russia in 2014 but still internationally recognized as Ukrainian territory.

The authenticity of the documents could not be independently verified, and Crimean authorities have not publicly commented on the leak. HUR has previously claimed responsibility for cyberattacks on Russia’s largest airline, a major drone supplier, and a state-owned aircraft manufacturer.

Ukraine’s cyber operation targeting state services in Crimea was likely carried out with support from the relatively unknown hacker group Kiberkorpus, which claims to be part of HUR and posted details of the attack on its Telegram page. Formed by IT specialists after the war began, the group says its mission is to gather intelligence and conduct operations in enemy cyberspace.

HUR has not publicly commented on Kiberkorpus’ involvement or affiliation. The group has previously claimed responsibility for other attacks on Russian targets, including a recent operation against telecommunications infrastructure in Crimea that disrupted access to some services, according to local media reports.

In previous cyberattacks, HUR said it had worked with pro-Ukrainian hacker groups such as BO Team and Blackjack. These groups claim to operate independently, though some researchers believe they are linked to government agencies.