‘We should know them by name’ COVID-19 patient data is leaking out of hospitals and police stations across Russia, leaving the sick and their families to face mass doxxing, threats, and harassment

In Russia, coronavirus patients are facing a mass wave of doxxing attacks, meaning that their identities and private data are being made public on messaging apps and social media. Meduza found that the attacks often stem from leaks of medical and law enforcement data that come directly from doctors and police officers themselves. The victims of the leaks then face harassment online and occasionally in person, with strangers threatening them and their families. Meduza investigative correspondent Liliya Yapparova traced the leaks to discover how the extreme circumstances of the COVID-19 pandemic have deprived Russian patients of their right to medical confidentiality.

“They see us as lepers”

On April 13, Angela Chernobayeva heard a noise in her stairwell and peered through the peephole in her door: someone had left groceries by her neighbor’s apartment, the plastic bags rustling as they hit the ground. The woman who reached out to grab the groceries was wearing a surgical mask, Ms. Chernobayeva noted with satisfaction. “And then, she went right back into her apartment. Good for her — sticking to the rules. Otherwise, I’d be really worried about her going out,” Chernobayeva told Meduza. She first learned that she should be keeping an eye on her neighbors from a social media page for her hometown, Suzemka. The town of about 8,500 people is located in the Bryansk region, near Russia’s Ukrainian border.

When a complete table of personal data for an elderly couple who had contracted COVID-19 was posted on that social media page, Angelina Chernobayeva realized that she lived right next door to their daughter, who may have been exposed to the disease. “I’m waiting for her test results to see whether I should keep being scared or not,” Chernobayeva said.

The elderly couple’s personal information was leaked online immediately after their coronavirus infections were diagnosed: On April 11, the town’s main VKontakte group posted the couple’s addresses, telephones, and even the names of their family members and friends. The leak had 11 victims in total, from the couple’s daughter’s partner to an ex-daughter-in-law. The data posted on VKontakte was initially collected by local authorities to be passed on to Russia’s federal consumer welfare agency, Rospotrebnadzor, and the post was ultimately deleted. Still, while it was up, Suzemka learned that the elderly couple has family members working in both the local grocer’s and the town hospital. On private messaging apps, the news spread fast. “And when the note with their last names was deleted [from VKontakte], everyone got mad: ‘They spread the infection — we should know them by name! What if we’re in danger now?” recalled a very different Angela, one of the couple’s family members.

A man named Alexey, whose parents were the couple targeted in the leak, told Meduza that the personal information posted on social media was compiled by a police officer: “The officer questioned me, and then that official piece of paper ended up on the Internet. Who did it? The police? The hospital?” he said in frustration. The data was intended for the Suzemka district’s branch of Rospotrebnadzor, as the document itself indicates. One member of Alexey’s family complained about the leak to the local police. “They told me I was ‘thinking about the wrong thing,’” recounted Svetlana, who is the elderly couple’s former daughter-in-law. “I mean, I was in tears and everything, and I was scared — it couldn’t hurt to call, right? And they told me, ‘The whole country’s fighting the virus. That’s what you should be thinking about.’”

It wasn’t just the family’s names that were leaked: their phone numbers and addresses are now public information, too. “My phone was blowing up for two days straight: they were just hammering and hammering and hammering away,” Alexey said. “They see us as lepers, as though I’ve caught the bubonic plague.” A day later, the police appeared: an officer took a photo of Alexey through his window and left without saying a word. “So that I’ll stay put and not put a toe out of place [until I get my results],” he said.

Dr. Natalia Zakrevskaya, the lead physician for Suzemka’s hospital, told Meduza that the sheet of paper bearing Alexey’s family’s personal data was “of no need” to her staff. She also said she didn’t know who leaked the information. Neither the Internal Affairs Ministry (which serves as Russia’s police headquarters) nor the country’s Health Ministry responded to requests for comment.

Much larger databases containing the personal information of Russians who were potentially exposed to COVID-19 have also leaked from police sources in recent weeks. In April, an Orenburg resident named Artyom who asked that his surname be kept private got a phone call from a number he didn’t recognize. The voice on the other end of the line sounded “very rude,” Artyom said, and the caller himself was “strangely intrusive.” The man called several times to ask one and the same question: “You know you’ve got coronavirus, right?”

The unknown caller got ahold of Artyom’s private phone number through yet another leak: in early April, a spreadsheet with 277 names was posted online under the label “List of individuals placed under observational control as potential carriers of COVID-19.” Artyom believes the list of names, addresses, and phone numbers is real: his family really has been placed under “observational control” after they returned from a trip abroad, and a group of police officers going door to door did collect their personal information. “And all the data we could verify in that leak was correct,” Artyom continued. “The fact that it ended up online is criminal negligence.”

If the spreadsheet is real, then it was made by Internal Affairs Ministry police officials, at least judging by the names signed on the spreadsheet itself. The database’s “initiator” is listed as Dmitry Borisovich Zakolodkin. A man with the exact same name was trained at Orenburg University as a jurisprudence major with a criminal law concentration; when we called Zakolodkin, he redirected us to the Internal Affairs Ministry’s press service, where questions about the leak and its origins went unanswered. The spreadsheet was endorsed by “Police Colonel O.V. Chernyavsky, police chief for the Orenburg Municipal Department of the Internal Affairs Ministry.” Oleg Chernyavsky really does occupy that post.

“Given the government’s efforts to achieve full control, I have no doubt that data about those infected is making its way both to healthcare agencies and to police agencies as well as to various ‘task forces,’” said Damir Gainutdinov, an attorney for the human rights group Agora who is currently working on the Orenburg leak. “It’s not just the police. It’s the healthcare system, it’s Rospotrebnadzor — leaks can happen at any of those levels.”

‘Overheard’ at the Health Ministry

The COVID-19 pandemic threatens Russians’ right to privacy and medical confidentiality nationwide, well beyond isolated cases like Suzemka’s and Orenburg’s. Personal information about potential coronavirus patients around the country is leaking out of the very same agencies that are trying to keep the outbreak under control. In five of the cases our investigation unearthed, medical workers themselves have been accused of leaking patient data.

On April 12, an elderly man wearing a mask and gloves entered a grocery store in Shadrinsk, a city of about 75,000 residents just east of the Ural Mountains. When the store’s employees saw him, they hid in a utility closet, leaving the man alone in the store. “My dad’s hands were shaking,” said Marina Makrushina, who has tested positive for the novel coronavirus. “He didn’t even end up buying anything. He just left.” The father of the Makrushin family had been planning to buy several weeks’ worth of groceries so that his family could self-isolate. They had just found out about Marina’s diagnosis.

The night before her father tried to stock up on food, Marina Makrushina had been taken by ambulance from Shadrinsk to the regional hospital in Kurgan. In the two hours it took the vehicle to reach the emergency room, the paramedic treating Makrushina learned from his colleagues that she had tested positive for COVID-19. The following morning, he posted in a group called “Overheard in Shadrinsk” telling locals that the city had its first confirmed patient.

When Makrushina’s address and even a photo of her face appeared in the comments on the paramedic’s post, she submitted a police complaint against him. The young woman believes local doctors are responsible for the incident: “To show the city that they’re doing their jobs, they arranged for my data to be leaked,” she said. “And then everybody started saying, ‘Marina Makrushina from Mir Street has coronavirus.’” The Health Ministry did not respond to questions about the circumstances surrounding the leak.

The harassment targeting Makrushina that began in the comments to the paramedic’s original post spread to most of the city’s social media pages and messenger groups. “People are posting photos of me in groups for their coworkers, classmates, friends, whoever, and saying, ‘look, this is the girl who brought it in.’ People are accusing me of intentionally coming here to infect my hometown!” Makrushina said.

Some of the messages making the rounds are threatening, and many of them are accompanied by coffin emojis. “My phone is blowing up. They’re tormenting my parents with phone calls, too. My friends have been warning me — they said, ‘You, when you come back, watch out — people are waiting for you here.’ In town, people are saying online that they’ll stone me, that ‘they should all be burned to death,’ that I ‘had better go into treatment at an asylum.’” Makrushina said. “You never know what to expect from a mob,” she continued, adding, “Dad’s just staying home now with the curtains drawn.” Since the leak, cars have begun driving up to the Makrushins’ home, rolling down their windows, and pausing while their passengers stare into the family’s living space for extended periods of time.

Other internal Health Ministry documents have found their way into the public eye as well. An operational brief on the COVID-19 pandemic from the central clinical hospital of Altai Krai was leaked on social media. The result was a wave of harassment targeting a woman from Barnaul, who blamed the leak on one of the hospital’s infectious disease doctors.

On April 12, the first case of COVID-19 was confirmed in Biysk, a city of about 200,000. “And literally the next day, a document showed up on social media, another operational brief, with all of [the patient’s] personal data: his surname, first name, patronymic, telephone number, address, and contact info for everybody he talks to, from his grandmother to his friends,” said journalist Natalia Rudakova, who is investigating the pandemic-related data leaks in Altai. “These documents seem to be spilling out because of people who work inside the system.”

Maxim Zlobin, the founder of a reputation protection agency called ISN, told Meduza that there was yet another leak of confidential medical information in the Pskov region. There, Zlobin claimed, the source of the leak was also a hospital, and the target was another COVID-19 patient.

In Zelenograd, a city near Moscow that houses about a quarter million, a family doctor began spreading the news that Yevgenia (name changed), one of his patients, had COVID-19 almost as soon as he saw her express test results. “As he was walking out of the lobby, he told the concierge, ‘we have a positive in Apartment 11.’ And that was it — everything went downhill from there,” Yevgenia said.

She soon reported both the doctor and the concierge to local prosecutors, writing that the concierge took it upon herself to tell everyone who walked into the building about the diagnosis. “Our neighbors would go into the lobby, and the concierge would just say to their faces, ‘there’s coronavirus in Apartment 11,’” Yevgenia told Meduza.

Meanwhile, in the Voronezh region, a set of documents addressed to the lead doctor of the Rossosh District Hospital leaked online, spreading personal information about the family of a teacher who had died of COVID-19. The leak monitoring company DeviceLock first reported that leak on its Telegram channel. Alphabetical lists of dozens of coronavirus patients also spread through social media in Dagestan, the Volgograd region, and Chuvashia. Ashot Oganesyan, DeviceLock’s CTO, said there were more than 10 such cases in the first half of April alone. “Typically, the format for these data is photographs of [paper] documents, and they leak out of regional-level medical institutions,” Oganesyan said. “In police headquarters, where there are [confidential operations departments] that monitor the circulation of secret documentation, there are fewer leaks. But at hospitals, where the whole idea of confidentiality is a novelty for many people, documents are accessible to anyone, and the employees who put them online, I’m sure, have no clue that their actions are punishable by law.”

Russia’s Health Ministry did not comment on these leaks and declined to answer Meduza’s questions about what steps the Ministry is taking to keep patient data confidential during the COVID-19 pandemic.

An epidemic of doxxing

“They were talking about eliminating the whole family, right down to the dog,” said Alyona, a resident of the Siberian town Ust-Kut who asked Meduza not to reveal her surname. On April 13, Komsomolskaya Pravda wrote that coronavirus-related harassment had spread to Alyona’s family: unknown actors had leaked her son’s positive test result only 20 minutes after the family itself found out about it. Alyona suspects that her family’s neighbors worked to spread claims that they had contracted COVID-19 on a trip they took to Thailand in March. “On Instagram, on WhatsApp, on [the Russian social media sites] Odnoklassniki and VKontakte — this messaging blast got going everywhere,” she said. “‘Burn them, kill them, shoot the mother, who didn’t just screw it up herself — she dragged her kids along with her.’”

The viral messages about the “family recently returned from Thailand” include complete sets of personal data about Alyona’s children, husband, and father. “Shoot the whole family,” wrote one Instagram commenter in response. “Shoot them and burn them.” Following the positive test result for Alyona’s son, the entire family, son included, received negative test results on April 15.

Social media users have echoed the violence of Alyona’s case even when the identity of their target is not yet known. “Give the medics machine guns,” wrote a number of VKontakte users when they saw a news video showing a man suspected of exposure to COVID-19 running away from a group of doctors. The broader trend in these incidents is clear: as the pandemic spread to smaller Russian cities and towns at the beginning of April, each new report of a local “patient zero” was almost always accompanied by attempts to reveal the patient’s identity, Meduza found. In Zarinsk, Altai Krai, users shared information about their first patient’s family. In Klin, not far from Moscow, a local social media group doxxed a nurse who contracted the new coronavirus (Meduza was unable to make contact with the nurse). One VKontakte user expressed shock at that post: “What is this for — so that half the town can go after this person with axes and pitchforks?” the commenter wrote.

In Moscow, arguments about medical confidentiality broke out in social media comment sections after the Telegram-centered news outlet Mash published an interactive map of the Russian capital’s infections. Mash does not name its sources for the map’s data, which show where coronavirus patients were living when they were hospitalized rather than where they are being treated. Still, when social media users begin discussing individual addresses included on the map, those conversations often end up including comments where users write publicly about their neighbors’ trips abroad, post contact information for coronavirus patients, or even supplement the map’s data to the point of naming the building entrance numbers where ambulances took patients to the hospital.

“We can’t rule out the possible effect that some people might troll other people, but I’d like to believe that this won’t escalate to the point of violence,” said Mash director Maxim Iksanov. “My main idea was to enable people to see how fast the disease is spreading so that they stay home.” Iksanov insisted on maintaining the secrecy surrounding his news outlet’s sourcing for the map. “We collect [data] from various sources. A lot of information just gets sent to our Telegram channel,” Iksanov said. He declined to comment when asked whether any of those sources are doctors or law enforcement employees.

What happens next

While the prevalence of harassment targeting COVID-19 patients and those merely thought to be exposed to the disease is evident, Meduza’s sources do not believe these apparent privacy violations will be thoroughly investigated.

“We’re treated like AIDS patients,” said Ilya (name changed), a Yekaterinburg resident whose family was boycotted by their neighbors after they returned from a trip abroad in late March. “The admin for our [apartment complex’s VKontakte] group posted an urgent status saying we had arrived and that we were supposed to stay home, meaning he banned us from going to the grocery store or taking out the trash. We mentioned that as we were going up to our apartment, we had touched the doorknobs [in the lobby], and there was just no stopping it after that.”

In Kumertau, Bashkortostan, one hospital designated for COVID-19 treatment had to ask for police protection. “Somebody had started walking around the hospital,” said Rifat Gainanov, whose mother, pensioner Azima Gainanova, is undergoing treatment inside the facility. “And we were on the first floor,” Gainanova herself added. “We were scared that someone might do something to us at the hospital to damage our health. The threats [on Kumertau’s social media pages] were scary — I don’t have WhatsApp, but my girlfriends told me.” “It wasn’t just going on for a day or two — people were talking about this in really harsh ways for a whole week,” Rifat Gainanov added. “People were writing, ‘We’re going to burn [their] families.”

Some state officials have begun taking steps to stem the tide of coronavirus-related harassment. The lead epidemiologist for the government of the Vologda region called on residents not to engage in hurtful online behavior. Russia’s federal Prosecutor General’s Office confirmed the doxxing of the couple in Barnaul and forwarded its findings to the Altai Krai’s regional FSB division. “When we’re under threat, our behavior is no different from that of herd animals,” mused Denis Miskvichenko, a senior lecturer in clinical psychology at the Moscow State University of Medicine and Dentistry. “We start defending the interests of those closest to us — our family members, our communities. It’s an instinctive defensive behavior, an attempt to turn circumstances that seem dangerous to us into something more controllable.”

The situation surrounding the hospital in Kumertau only escalated as it did after an unknown source leaked patient data online. Zlobin, the reputation protection company founder, predicted that incidents like these will lead large numbers of Russians to go to court once the COVID-19 epidemic has passed. “For example, a person who had contracted the coronavirus got in touch with us because his personal information had been made public in one of those ‘Overheard’ groups. The situation feels like some dysfunctional kind of persecution. Someone even put a note in the lobby of this man’s building saying he was ‘a murderer who’s infected us all,’” Zlobin said. “And when the coronavirus is over, people who hadn’t had shit written about them online before will do a search for their names and find posts that say, ‘Ivan Petrov is a contagion, and everyone in his family is terrible.’”

The sources who spoke with Meduza declined to predict whether or not courts will ultimately be able to force Russia’s COVID-19 leaks off of the Web. “Before the coronavirus, 90 percent of plaintiffs were never able to get information about themselves removed from search engines [in court],” said Zlobin. Gainutdinov of Agora agreed: “Article 152.2 of [Russia’s] Civil Code [on the confidentiality of private information] allows plaintiffs to demand that information about their private lives be removed from the Internet, but taking something off the Web is fundamentally really difficult. That’s even more true given that in most cases, these materials are being sent out on social media. You can get a court decision saying the information has to be deleted, but making sure it’s enforced is much harder,” he said.

When Meduza reached out to the social network VKontakte for comment, a representative replied, “VKontakte forbids the publication of users’ personal information, including addresses, telephone numbers and passport numbers. We delete those kinds of posts. There is also no place on VK for harassment or threats of violence. […] At the same time, we have not detected an increase in this kind of content.” A representative for Odnoklassniki said that company has also not seen a “surge of situations like these,” adding, “We actively delete posts and comments with that kind of content both based on user complaints and using automatic algorithms.”

Gainutdinov said he does not believe anyone will investigate the COVID-19 doxxing incidents thoroughly. “When a database on Moscow’s protesters was shared online in August 2019, the Investigative Committee forwarded citizens’ complaints to the Internal Affairs Ministry, and the Internal Affairs Ministry just said, ‘everything’s OK, and there are no signs of criminal activity,’” the attorney recounted. “Roskomnadzor [Russia’s federal media regulation and censorship agency] also sent a formal note writing it off. So I’m pretty skeptical about the potential for cases like these [to be prosecuted] on a national level — primarily because the government is obviously not interested in having incidents like these investigated. That’s not nearly as interesting or as simple as looking around for fake news.”