Hackers Breach VSK Insurance, Risks for Clients

On November 12, hackers attacked the large insurance company VSK, its services are still “down”. Clients are complaining on social networks that they are not being helped even in the offices where the company asks them to go. Some cannot get help with voluntary medical insurance (VHI), others are losing money due to delays with leasing documents.

Four days after the outage, Kommersant reported that VSK’s owners are already looking for buyers for the business, but the company called these claims unfounded. MSK1.RU investigated what happened.

VSK is a large insurer working with OSAGO (compulsory motor third-party liability insurance), CASCO (comprehensive auto insurance), VHI (voluntary medical insurance) and property insurance for legal entities. Among the company’s clients are more than 33 million Russian citizens and over 500 thousand enterprises.

What Clients Are Complaining About

In VSK’s VKontakte group, clients are asking when everything will work, and company representatives promise to do everything possible to quickly restore services. People complain that they cannot reach specialists by phone, and sometimes even get help in the office.

The most dissatisfied are discussing filing a complaint against VSK in court.

“If there are no clear deadlines for restoring functionality, I suggest writing a collective statement to the court. They took the money, but they are not fulfilling their obligations,” writes Daniil.

“On Tuesday, I submitted an application to make changes to my OSAGO, to add a driver, and on Wednesday, the hacker attack. It’s both funny and sad,” complains Regina.

“I am interested in when I can get my CASCO documents, which I need for further proceedings with the other insurance company’s accident participant. VSK did not give me the insurance for free, I paid for it. Why is the insurer behaving so unscrupulously, not fulfilling the contract terms?” wonders Irina.

“Is it impossible to renew CASCO? Do I need to look for another insurance company?” tries to understand Yekaterina.

“If you are repairing for so long, then after all, the database was also damaged or wiped clean. How crude was the infrastructure that it collapsed from a mere hiccup,” reasons Dmitry.

Who Attacked VSK

The company recorded a large-scale cyberattack on its systems on November 12 and has been trying to restore the infrastructure since then. VSK assures that only the infrastructure was affected — client and partner data is safe, offices are operating normally, and the company is fulfilling its obligations.

One of the Ukrainian cyber groups stated that the insurance company was attacked by anonymous hackers. Allegedly, they damaged the infrastructure and even erased the backup data copies.

The system is completely down, even the email mailbox is unavailable. The company suggests sending requests by paper mail.

“Unfortunately, none of the services are working,” was the response by phone to an MSK1.RU journalist’s question about how to contact the press service.

Why Companies Are Hacked

Cybersecurity consultant from Positive Technologies Alexei Lukatsky explained to MSK1.RU that foreign hackers have been hacking company systems for the last three years not for money, but due to politics. He considered the version that the attack was a way to lower VSK’s price untenable.

What the Hack Threatens VSK Clients and When Everything Will Be Restored

As Alexei Lukatsky reported, the collapse of VSK’s systems threatens its clients with not being able to quickly use the services.

“If, for example, a client is abroad and needs emergency hospitalization, they may not receive it in time because the process has become much more complicated and slowed down,” said Lukatsky.

How quickly everything will be restored depends on the availability of copies and whether VSK tested their restoration, says Lukatsky. How prepared they were is unknown.

“Based on the experience of other companies that were hacked in the last three years, if they did not pay proper attention to recovery processes, it can take from several days to weeks,” the expert said. “Restoration of secondary functions can take several months or even more.”

How Users Can Protect Themselves and Whether to Expect New Attacks

Alexei Lukatsky warns that users have no control over the security of their data in the databases of companies targeted by hackers. If malicious actors destroy the infrastructure — the user loses access to services. If they steal personal information — it falls into the hands of fraudsters, and they can use it.

The expert observes that over the last three years, the number of attacks has increased — this reflects the “geopolitical situation”. He believes that cyberspace will become increasingly dangerous and that large companies will still suffer from hackers.

“Many organizations, unfortunately, underestimate the issue of cybersecurity. This leads to them facing catastrophic consequences. Not all will be able to effectively emerge from this kind of incident, they will suffer quite serious reputational and very large financial damage,” forecasts Lukatsky.

The interlocutor cited the example of the cyberattack on automaker Jaguar Land Rover, which even affected the UK economy — it caused damage of $2.5 billion. Experts from Cyber Monitoring Centre assume that production will be fully restored only by the beginning of January 2026.

How Cybersecurity Is in the Country

In 2025, the number of cyberattacks on critical infrastructure in Russia soared four times. TASS reported this citing the Security Council’s press service.

Further — more. As Forbes writes with reference to research by cybersecurity specialists, in 2026, successful cyberattacks in Russia may increase by 30–35%.

At the same time, there is a shortage of experts capable of protecting infrastructure, Vedomosti reported based on a hh.ru survey. In January–August, demand for them grew: in mechanical engineering — by 40%, in energy — by 64%, in trade — by 75%.

In July, hackers disrupted the work of IT systems at Aeroflot, dozens of flights had to be canceled or delayed. At the same time, a cyberattack caused a failure in the networks of pharmacies “Stolichki” and “Neopharm”. In September, organizers of the Eastern Economic Forum announced a repelled attack on their systems.