The leader of the Russian-speaking hacking group KillNet, known online as KillMilk, claimed to have compromised NATO information systems and put portions of private data belonging to North Atlantic Alliance members up for sale. These allegations were shared on a Telegram channel run by the hacker group.
KillMilk asserts that the breach grants access to NATO military procedures, personal information about cadets and their officers, and control over a large number of computers. The hacker described the archive as containing gigabytes of data and asked for three bitcoins in exchange, which was roughly seven and a half million rubles at the time of the report on April 13, 2023, according to the Telegram post and accompanying chatter within the community.
In the message, KillMilk warned that after receiving the ransom and access, a new data slot would be opened for potential further exploitation. The claims imply a ransomware style payoff, followed by additional attempts to monetize leaked information.
Analysts suggest the NATO data could have been exfiltrated after a cyber intrusion into the alliance’s network infrastructure around April 10. Some reports indicated that as a result of the incident, a sizable portion of NATO network resources experienced disruption, with estimates ranging up to 40 percent in certain segments. This size of impact has prompted ongoing investigations and heightened attention to the security of alliance networks.
Earlier reports from socialbites.ca indicated that on the day Finland joined NATO, Finnish organizational websites faced unauthorized access and defacement, signaling a broader pattern of opportunistic cyber activity around major geopolitical events. While the exact attribution remains subject to investigation, the sequence of incidents underscores persistent tensions in cyber domains and the potential for cross-border digital intrusions to influence perception and policy. The evolving landscape continues to drive calls for strengthened defensive measures and coordinated responses across allied networks.