EMET NEWS PRESS

Who faces the highest risk?

The highest-risk category consists of Russian nationals whose cooperation with ZOiS could be clearly reconstructed from the affected data and who remain accessible to Russian authorities. This includes persons who travel regularly to Russia, maintain professional or academic ties in the country, or have relatives who could be subjected to administrative or economic pressure.

For this group, a data set containing project work, interviews, events, publications or institutional correspondence could have consequences beyond a privacy breach. It could support border questioning, administrative summonses, investigative measures or coercive pressure directed at an individual’s personal environment.

A medium-level risk applies to Russian researchers, exile actors and former cooperation partners residing outside Russia whose connection to ZOiS may become visible through a possible data breach. Their immediate accessibility to Russian authorities is lower. The risk increases substantially where they continue to travel to Russia, maintain relatives there, remain connected to Russian institutions or communicate regularly with individuals inside the country.

A lower but still relevant risk applies to non-Russian nationals working in research, diaspora, media or civil-society networks with a Russia focus. For this group, the principal exposure concerns intelligence collection, contact mapping and targeted digital deception operations.

Why the “undesirable organisation” designation matters

Russia designated ZOiS an “undesirable foreign organisation” on 13 October 2023. This legal category prohibits the organisation’s activity in Russia and criminalises cooperation by Russian nationals. According to ZOiS, this may also apply when the cooperation takes place outside Russian territory.

A possible data breach therefore creates a concrete pathway for repression. Not every recorded contact would automatically be usable in criminal proceedings. However, a documented link to projects, events, research cooperation or publications may create significant exposure for affected individuals.

The operational impact does not depend solely on the volume of data taken. The decisive factor is whether the data can establish a credible connection between a name, Russian nationality, contact with ZOiS and the specific nature of the cooperation.

Which data would be operationally exploitable?

The most sensitive files would be those combining identity, institutional role, contact network and research activity.

Contact lists, participant registers and project correspondence may contain names, email addresses, telephone numbers, workplaces, communication links and records of previous cooperation. Research material may reveal interview partners, source environments, travel-related information, regional networks or political focus areas.

The operational value increases through data fusion. Individual fragments can be combined with public professional profiles, social-media data, previous breaches or Russian administrative records. This can produce usable personal and relationship profiles.

Three forms of exploitation are plausible for a repressive or intelligence actor:

Identification and coercive pressure: Documented contacts could be used during entry screening, questioning, administrative procedures or investigations. Relatives in Russia may become an indirect pressure point.

Mapping of wider networks: Project and contact records may reveal which researchers, interview partners, institutions and civil-society actors are relevant to Russia analysis, exile structures or political research.

Digital follow-on operations: Knowledge of authentic project names, contacts, working procedures and communication patterns increases the credibility of targeted phishing and social-engineering attempts. Attackers could impersonate ZOiS staff, IT support, data-protection personnel, research partners or security authorities.

ZOiS has warned of targeted deception attempts and potential unauthorised direct-debit activity. These risks extend beyond institute staff to all persons whose contact or payment data may have been stored on compromised systems.

Attribution remains open

Russian responsibility has not been established. No public technical indicators currently permit attribution to Russian intelligence services, a known APT group or a criminal actor.

Russia should therefore not be identified as the perpetrator.

The target profile nevertheless remains security-relevant. ZOiS works on Russia, Belarus, Ukraine, diaspora communities, societal developments and regional security. Russia formally designated the institute an “undesirable organisation” in 2023. Data from this environment may be of interest to state intelligence services, repressive security bodies or criminal actors seeking to monetise sensitive records.

The repression risk remains even if the intrusion was initially financially motivated. Exfiltrated data can be sold, combined with other holdings and later exploited by actors with different objectives.

Protection requirements for affected persons and comparable institutions

ZOiS should combine technical investigation with a graded notification process for potentially affected persons. Russian nationals, individuals travelling to Russia and persons with relatives in the country require separate risk assessments. The key question is whether their identity, project role and connection to ZOiS may have become jointly identifiable.

The institute should also centrally record suspicious approaches directed at staff and external partners. Messages using correct project names, familiar contacts or credible internal procedures would indicate possible use of compromised contextual data.

Contact, project, communication and payment data require separate assessment during the forensic process. A compromised participant list creates a different risk profile from project correspondence or payment-related records. Notification of affected persons should reflect these distinctions.

Institutions with comparable Russia-related exposure should retain sensitive contact data only where operationally necessary. High-risk project and personal data should be separated, encrypted and governed by defined access rights. Named contacts at data-protection authorities, security services and specialised incident-response providers should be established in advance for incidents of this type.

Assessment and Outlook

The subsequent course of the incident depends first on an unresolved technical question: whether the attackers copied files and whether those files contained personal, contact or project-related material. Until this is clarified, neither the scale of the compromise nor the likelihood of targeted follow-on activity can be assessed with confidence.

Should contact or project files have been exfiltrated, the risk of context-specific phishing and social-engineering activity would increase substantially. This assessment is based on a direct operational relationship: authentic names, project terminology, known contacts and internal procedures reduce the effort required to construct convincing deception against selected targets. The first meaningful indicator of escalation would therefore not be a public claim of responsibility or a political attribution. It would be repeated contact attempts showing precise knowledge of ZOiS projects, staff members or past cooperation formats.

Repressive action against individual Russian nationals remains a medium-term possibility rather than an immediate certainty. It would require usable data to have been exfiltrated, those data to become available to Russian authorities or aligned actors, and the affected persons to remain reachable. Travel to Russia, continuing institutional links and relatives inside the country materially increase this exposure.

The incident fits an established threat environment: institutions working on Russia frequently hold data on individuals who may be vulnerable not only to digital collection, but also to transnational repression. The ZOiS case can therefore only be assessed conclusively once technical forensics, data classification and any follow-on activity are evaluated together.

References

Centre for East European and International Studies — IT Security Incident at ZOiS
www.zois-berlin.de/ueber-uns/aktuelles/archiv-2026/it-sicherheitsvorfall-am-zois

Centre for East European and International Studies — Statement on the Designation of ZOiS as an “Undesirable Foreign Organisation” in the Russian Federation
www.zois-berlin.de/ueber-uns/aktuelles/erklaerung-zur-einstufung-des-zois-als-unerwuenschte-auslaendische-organisation-in-der-russischen-foederation

Federal Office for the Protection of the Constitution — Threats from Russian Espionage, Sabotage and Disinformation
www.verfassungsschutz.de/SharedDocs/publikationen/DE/spionage-und-proliferationsabwehr/2025-05-gefaehrdungen-durch-russische-spionage-sabotage-und-desinformation.html

Federal Office for the Protection of the Constitution — Cyber Attacks
www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2026-02-cyberangriffe.pdf