Armenia Investigates Alleged Sale of 8 Million Government Notification Records

Armenian authorities opened an investigation after a threat actor using the alias dk0m advertised for sale a dataset allegedly containing nearly 8 million government-related records tied to a state notification system used to distribute official legal and administrative communications. The data was marketed on an underground forum for $2,500 and was described as including notifications and communications associated with police and judicial bodies; officials in Yerevan publicly denied that the country’s government email infrastructure had been breached while acknowledging the possibility that another state platform was accessed.

Armenia’s Public Relations and Information Center (PRIC) said a preliminary review indicates the leaked material may have originated from the electronic civil litigation platform, and that an internal probe is ongoing to confirm the source and access path. Researchers at CyberHUB-AM assessed dk0m as a recurring data broker active since at least 2024 and reported the actor commonly uses infostealer malware to harvest credentials/session data and identify access to sensitive government portals before repackaging and reselling datasets; screenshots reportedly dating to August 2024 were cited as supporting evidence. The alleged exposure could increase social engineering risk by enabling highly credible scams referencing real case numbers, fines, or enforcement actions.