Russian platform compromise (2026-07-23): what to know

Developing story — first detected 2026-07-23 (UTC). This alert is based on early reporting of a platform compromise and will be updated as Russian, researchers and agencies confirm details. Reported figures are claims, not verified facts, until the vendor or a national cyber agency confirms them. This is general safety information, not legal, financial or security-engineering advice.

Multiple outlets are reporting a platform compromise involving Russian. The first hours of a cyber story are exactly when follow-up scams start — fake "breach notifications", bogus password-reset and account-lock emails, phoney support lines and impersonation calls all arrive while people are anxious and before official guidance lands. Attackers increasingly use AI to scale those lures, clone voices and spin up convincing lookalike sites within minutes. This page explains what has been reported so far, how to check what's real, and the steps worth taking right now. If a suspicious message about Russian has already reached you, run it through our free scam checker before you act on it.

What's being reported

As of 2026-07-23, recent coverage includes:

• “Russian Hackers Exploit New ‘Zero-Click’ Attack Against Western Organizations”
• “Russian Hackers Exploit Zimbra 0-Day Against US, Ukraine Targets”
• “Russian hackers exploit Zimbra zero-click flaw for email theft”

The scale, root cause and even the confirmed existence of an incident can change quickly in the first hours. Treat numbers in headlines as provisional until Russian or a national cyber agency (such as the US CISA or the UK NCSC) confirms them.

Has Russian confirmed it?

At the time this alert was generated, we had not yet linked an official statement. Vendors publish incident and vulnerability advisories on their security or trust pages, and government agencies issue advisories when a flaw is being exploited in the wild. Never rely on an email, text or call to tell you whether you're affected — type the address yourself or use an app you already trust.

The real danger right now: follow-up scams

After every widely reported incident, criminals exploit the headlines — whether or not they hold any stolen data or working exploit:

🚩 Fake breach notifications telling you to "verify your identity", "secure your account" or "reset your password" through a supplied link. Real notices name the official website and never ask for passwords, one-time codes or card details.

🚩 Credential-stuffing and phishing waves. If real data leaked, attackers replay exposed passwords across other sites. Check your exposure at Have I Been Pwned and change reused passwords.

🚩 Fake support numbers and "help" pages that ride the search-result and social-media noise around the incident and try to sell you a fix or take remote control of your device.

🚩 Impersonation calls quoting real details. A caller who knows your name, employer or account history proves nothing — hang up and call back on a number from the official website.

Unsure about any message or caller? Use our free scam checker first.

What to do now — 7 steps

1. Don't click links in incident-related messages. Go directly to the vendor's website or app for statements and patches.
2. Verify any contact independently using a phone number from the official website — never one supplied in a message.
3. Change your password for the affected service to a long, unique one, and anywhere you reused it. Turn on multi-factor authentication, starting with your email account.
4. Apply official updates promptly if this is a software vulnerability — but only from the vendor's own update channel, following the relevant CISA advisory or vendor guidance.
5. Watch bank and card statements and query unexpected transactions with your bank immediately.
6. Check your exposure at Have I Been Pwned and stay alert to phishing that references this incident.
7. Report scams and cybercrime to your national body (see below). Already clicked or paid? Follow our damage-control checklist now.

Where to report and get official help

• 🇺🇸 USA: CISA — recognise & report phishing · FTC ReportFraud · FBI IC3
• 🇬🇧 UK: NCSC phishing guidance · Action Fraud
• 🇦🇺 Australia: ReportCyber / ACSC · Scamwatch
• Everywhere: your bank's number on the back of your card, at the first sign of unusual activity.

Frequently asked questions

How do I know if I'm affected by the Russian incident?

You likely can't yet. Vendors confirm scope through official advisories and direct notifications, which take time. Watch the official website, check Have I Been Pwned, and be suspicious of anyone who claims they can check for you.

Should I do anything before it's confirmed?

Yes — the low-cost steps above (unique password, MFA, patching, statement checks) are worth doing regardless, and they blunt the scams that exploit the headlines either way.

Is a message about this incident legitimate?

Assume not until proven otherwise. Verify through the vendor's official website or advisory, and check the message with our free scanner — it flags breach-compensation lures, lookalike domains and known-reported scam contacts.