State Secret Sold for a Manicure: 1.4 Million Classified Records Exposed in Ukraine

An unexpected and absurd cybersecurity scandal within the National Police of Ukraine has shaken the entire network. After a police officer fell for a fake discount offer from a social media beauty salon, hackers gained full access to the internal security system. As a result, classified statistical documents regarding the scale of mobilization, military commissariat (TSK) reports, and street raids conducted across Ukraine over the first 7 months of 2026 were leaked to the public.

“The Beauty Salon Trap”: How did hackers obtain state secrets?

The acquisition of classified data was not the result of a complex technical attack, but rather a simple human factor and phishing trick:

• 3 free visits: A police officer was found on social media and sent a fake link offering “3 free manicures” from a popular beauty salon;

• Internal databases opened: Once the officer fell for the link, hackers gained full access to the National Police’s Internal Security Department, the “Zapit” criminal record check system, and the employees' workstations;

• Cameras in meeting rooms: Even surveillance cameras and microphones in rooms where leadership meetings are held were compromised, allowing hackers to listen to classified briefings on missile strikes and casualties.

1.4 million database and street raids: The real numbers of mobilization

The published official document table shows the scale of actions taken across Ukraine in the first seven months of 2026:

• 1.4 million citizens under surveillance: A total of 1,409,688 individuals have been entered into the unified registry database;

• 228 thousand citizens detained: A total of 228,626 men were detained by notification groups and at checkpoints and sent to the Military Medical Commission (VLK);

• 174 thousand medical examinations: Of those detained, 174,120 were found fit for service after medical examinations;

• 170 thousand people to the front: Among those examined, 102,548 were forcibly mobilized, 69,525 were registered as “volunteers,” with a total of over 170,000 people sent to the front line;

• 148 thousand draft notices: Since the beginning of the year, a total of 148,550 draft notices (povestka) have been personally delivered to citizens.

Regional differences: Street hunts vs. volunteers

The documents revealed sharp differences between Ukrainian regions:

• Highest forced mobilization: The highest rates of picking up men from the streets were recorded in Dnipropetrovsk (13,000), Kyiv region and city (over 16,000 in total), and Odessa region (9,000);

• The Lviv phenomenon: In the Lviv region, located in the west of the country, the rate of street detentions was the lowest, but the number of volunteers who came of their own accord was the highest (over 4,000);

• Lack of enthusiasm: The southern frontline regions and the Odessa region show the lowest number of people joining the army voluntarily.

Do you think the breach of critical systems containing state security and military secrets for a single free service shows how vulnerable modern digital security is? What do you think about such tragic incidents caused by a lack of cyber hygiene? Leave your thoughts in the comments!