Russia's National Coordination Center for Computer Incidents (NKTsKI) has issued a warning to organizations in the country's credit and financial sector regarding a security breach at LANIT, a leading Russian IT service and software provider.
The alert, also published on GosSOPKA’s (State System for Detection, Prevention, and Elimination of Consequences of Computer Attacks) website, states that the attack occurred on February 21, 2025. The incident may have affected LLC LANTER and LLC LAN ATMservice, both subsidiaries of the LANIT Group of Companies.
LANIT Group is a key player in Russia’s IT sector and the nation’s largest system integrator, with a client portfolio that includes the Russian Ministry of Defense and entities within the military-industrial complex, such as Rostec. Due to these associations, the U.S. Department of the Treasury imposed sanctions on LANIT in May 2024.
LLC LANTER and LLC LAN ATMservice specialize in banking technology, developing software solutions for banking equipment, payment systems, and Automated Teller Machines (ATMs).
Following the breach, NKTsKI has advised all potentially impacted organizations to reset passwords, update access keys, and modify remote access credentials.
"NKTsKI recommends that all organizations immediately change passwords and access keys for their systems hosted in LANIT's data centers," the bulletin states. "If your infrastructure uses LANIT group developments and software products, and LANIT engineers have been granted remote access, it is also recommended to change connection credentials."
"Additionally, it is advised to enhance monitoring of threats and information security events in systems that were developed, deployed, or maintained by engineers from the LANIT Group of Companies."
A detailed PDF document has been provided with further security recommendations, outlining measures to mitigate threats from compromised external channels.
NKTsKI has not disclosed how the attackers infiltrated the LANIT network, the exact timeline of the breach, the extent of the compromised data, or the perpetrators behind the attack.
In recent months, Russian ATM operators and banks have faced repeated cyberattacks from Ukrainian hackers, who frequently use distributed denial-of-service (DDoS) techniques to disrupt operations.
However, the latest warning suggests a deeper infiltration into a major service provider’s systems, raising concerns about potential widespread supply chain vulnerabilities.