Belarusian hacktivists admit to 2023 breach of Russian state healthcare network

Belarusian activist hackers have claimed responsibility for a years-old breach of Moscow's healthcare network, confirming their involvement in an intrusion recently disclosed by a Russian cybersecurity company.

In a statement on Friday, the Belarusian Cyber Partisans said they infiltrated the Moscow Department of Health in 2023 and obtained administrator-level access to its infrastructure, including systems connected to other government agencies.

The group said it spent months inside the network before abandoning the operation.

"The network was not a priority for us, so we did not maintain our access," the group said in a comment to Recorded Future News. "We gained full access to its entire infrastructure relatively quickly and with little effort."

A representative of the group also said it currently had access to hundreds of IT systems across Russia and Belarus, a claim that could not be independently verified.

The Cyber Partisans' statement follows a report published last week by Russian cybersecurity firm Solar, a subsidiary of state-controlled telecom giant Rostelecom, which identified the group as the likely perpetrator of a long-running intrusion into an unnamed Russian healthcare organization.

Solar said it discovered the breach in December 2025 and traced the earliest signs of the intrusion to early 2024, suggesting the hackers may have remained inside the network for nearly two years.

The Cyber Partisans said they had gained access a year earlier and had not attempted to maintain it after completing their objectives.

Solar said the targeted organization operated an extensive IT network connected to numerous other healthcare institutions, potentially allowing the attackers to access additional systems.

According to the researchers, the hackers accessed sensitive medical information but did not destroy data or disrupt the organization's operations.

The group did not disclose what information it obtained but told Recorded Future News that medical information collected during cyber operations could help it assess Russian military casualties in the war in Ukraine.

The Cyber Partisans said most of their current operations remain secret and that they could not disclose information obtained from the Moscow healthcare network for operational reasons.

“We take this opportunity to acknowledge responsibility for the hack and agree with the report's authors on at least one point: No matter how hard the Russians try to defend their systems, the Cyber Partisans ‘find and will continue to find ways around’ their security measures,” the hackers said in a statement. 

The group emerged after mass protests against Belarusian President Alexander Lukashenko following the country's disputed 2020 presidential election, which Western governments rejected as fraudulent.

The activists have since claimed responsibility for major cyberattacks against Belarusian government institutions and the country's railway system. Following Russia's full-scale invasion of Ukraine in 2022, the group expanded its operations against Russian targets, including attacks aimed at gathering intelligence and disrupting infrastructure.

In July, Russia's Supreme Court designated the Cyber Partisans an “extremist organization,” accusing the group of seeking to destabilize Russia and Belarus and overthrow Lukashenko's government. The designation was the first of its kind applied by Russia to a hacking group.