Max Messenger Suffers Major Data Breach: Hacker Claims Full Infrastructure Compromise A hacker operating under the alias CamelliaBtw has claimed responsibility for a severe data breach targeting Max Messenger, a state-backed Russian messaging platform. The breach, announced on the DarkForums cybercrime marketplace, alleges a complete compromise of the app’s production systems, user data, and backend infrastructure exactly one year after its public launch on March 26, 2025. About Max Messenger Developed by VK’s subsidiary Communication Platform LLC, Max Messenger was introduced as a "national" alternative to platforms like WhatsApp and Telegram, integrating messaging, voice/video calls, file sharing, and government-linked digital identity services. Pre-installed on devices in Russia and Belarus under government policy, the app has amassed millions of users. Critics have long raised concerns over its privacy implications, given its deep ties to Russia’s digital infrastructure. Breach Details According to the hacker’s post, the attack exploited an unpatched remote code execution (RCE) vulnerability in Max’s media processing engine, present since the app’s 2025 beta phase. The flaw, triggered by malformed sticker pack metadata, allowed persistent access to the platform’s backend. The stolen data totaling 142 GB includes: - 15.4 million user records (full names, usernames, verified phone numbers) - Active authentication tokens (capable of bypassing 2FA) - Bcrypt-hashed passwords - Complete metadata (timestamps, sender/receiver IDs) - Internal assets (SSH keys, API docs, S3 bucket configs) - Unencrypted media files - Backend source code, including alleged hardcoded backdoors in the encryption module Extortion Threat CamelliaBtw claims to have privately notified Max Messenger’s developers but received no response. The hacker has issued a 24-hour ultimatum, demanding a financial settlement labeled a "bug bounty." Failure to comply would result in the release of 5 GB of raw SQL data across public torrent trackers. The post highlights verified accounts belonging to politicians and corporate executives as potential targets. Current Status As of now, Max Messenger has not confirmed or denied the breach, and no sample data has been publicly verified. Cybersecurity experts note the technical specificity of the claims suggests credibility, though the incident remains unconfirmed. If validated, this would rank among the most severe messaging platform breaches in recent years, with significant implications for user privacy and trust in encrypted services.