You’ve Got Spam: The Kyiv Independent Hack
by Robin Dost
Someone gained access to the Kyiv Independent’s publishing and newsletter systems.
They could put words on a trusted news website and messages into its readers inboxes.
What arrived in mine was a Russian-language nuclear scare, an English version announcing that “the hazelnuts are flying” and a fabricated report that Volodymyr Zelensky had been shot.
All three advertised the same Telegram handle.
I followed the incident as it unfolded on November 4, added the advertised channel into my tracking and preserved screenshots and Telegram exports.
The resulting record contains a serious compromise, some remarkably bad propaganda and an operator who apparently needed unauthorized access to discover that an English-language publication has readers abroad.
Three emails in my inbox
The three messages I received arrived within 39 minutes.
These are my recorded receipt times, not independently established server-side sending times.
| November 4: recorded receipt | Language | Message |
|---|---|---|
| 13:39 | Russian | Falsely alleged a Ukrainian nuclear attack, insulted the developers, told readers to shelter and promoted @iamgirlhacker. |
| 14:11 | English | Repeated substantially the same claims, with the memorable warning: “The hazelnuts are flying.” |
| 14:18 | Russian | Falsely claimed Zelensky had been shot at the Russian border and advertised supposed footage on Telegram. |
Another thing worth noting is that the attacker sent his emails from newsletter@kyivindependent.com, not from news@kyivindependent.com.
Someone obviously didn’t do their homework here.
The English message deserves a moment.
The Russian text says “Летит орешник,” apparently referring to the Oreshnik missile.
In the English version, the threat becomes airborne hazelnuts.
It reads like a literal translation that nobody bothered to check.
The text alone does not tell me whether a translation service, an AI model or a human produced it.
Whatever the workflow, the result was an emergency warning from the mixed-nuts aisle.
The language mismatch matters beyond the joke.
Two of my three messages were in Russian, delivered through an English-language publication.
The English attempt retained the same incoherent story and abuse.
There was little effort to make any of it resemble the journalism readers had subscribed to receive.
The Kyiv Independent’s own incident statement reports four unauthorized emails in total, including an earlier overnight message.
It confirms access to its CMS and one newsletter service and says staff removed malicious website posts.
My three emails therefore document part of the incident.
The website became an advertisement
A briefly visible website post carried the title “Telegram Channel – @iamgirlhacker,” followed by “YOU HAVE BEEN HACKED AGAIN” and the channel address.
My screenshot shows it inside the normal article layout, with an Olga Rudenko byline and a displayed publication time of November 4, 2026, 2:35 p.m.
That byline is part of the compromised pages presentation.
It does not establish that Rudenkos personal account was the entry point.
The repeated word “again” is also the attackers wording.
The visible objective was remarkably consistent here: Use the publications distribution to send people to Telegram.
The operator had access to a newsrooms publishing surface and used it to write a channel advertisement.
Please visit our channel. Please stop replying.
The advertised public channel used the name “Сумасшедшая” and the handle @iamgirlhacker.
The channel records over a hundred subscribers and channel ID 3936856722.
Its earliest visible posts are dated November 3 and the first minutes of November 4.
The screenshot also records a channel-photo removal event.
The channel advertised @GreyLuzov as a contact “for our team.”
I recorded the associated profile, displayed as Grey Luzov, with user ID 8858778739.
During my observation, the contact reference was removed and the profile photo disappeared.
The linked discussion is where the promotional campaign became especially entertaining.
At 14:10:51 CET, the exported conversation records a /ban command posted under the channel identity after the Rose moderation bot had been invited.
The bot initially requested group verification.
Further commands were followed by two successful bans at 14:11:10 and 14:11:26.
The preceding messages from those users were insults directed at the attacker.
Apparently, bringing an audience into the chat was more appealing than hearing from it.
I also recorded a second, private channel advertised using @iamgirlhacker as its displayed name.
The channel ID is 4356723419 and has three subscribers at that point.
That snapshot suggests very limited uptake during my observation, it says nothing about its later audience.
Breaking: people outside Ukraine read about Ukraine
At 23:19:15 CET, the channel identity posted a longer boast in the discussion.
It claimed access to the Kyiv Independent’s database and presented subscriber geography as a devastating revelation.
The alleged figures were 242.386 subscribers, including 64.242 Americans and 2.393 people in Kyiv.
It also claimed 33.498 paid subscriptions, with more than 10.731 attributed to Americans.
These are attacker-supplied figures.
The preserved material contains no subscriber database dump with which to validate them.
Even taken at face value, the argument falls apart.
An English-language Ukrainian outlet has an international audience.
That is not a hidden dependency exposed by a hacker. It IS the product.
The Kyiv Independent’s public description of its mission and funding explicitly explains its international role and reader-supported model.
Someone could have learned that without breaking into anything.
There are also several less entertaining problems with the posts reasoning.
A Kyiv city count is not a count for all of Ukraine.
Newsletter subscriber records do not represent every website reader.
An address or location field does not, by itself, establish nationality.
And on the operators own numbers, Americans account for roughly 26.5% of the alleged total, hardly evidence that everyone else is absent.
The paid-subscription figures are equally unhelpful to the insinuation.
The quoted American count is around 32% of the claimed paid total.
Counting subscriptions does not reveal the share of revenue they generate, the origin of payment cards, or who controls editorial decisions.
The post also listed government, military and academic email domains, including state.gov, mail.house.gov, army.mil and .edu addresses.
Even if those entries are genuine, their presence would show addresses recorded in a subscription system.
It would not prove that an institution directed the newsroom, that every address was verified or actively reading or that any government mailbox had been compromised.
Finally came the accusation that a “Paid” setting was disabled while money was still being collected.
Without the underlying configuration and billing arrangement, this proves nothing.
A product label or disabled signup option does not explain existing subscriptions or external payment flows.
The grand exposé was that international readers support international reporting.
Excellent work.
The About page was right there.
Accounts are evidence. Avatars are not attribution.
Another account I recorded used @char_00007, user ID 9236222396, this is a fake account using someones real name an photo, so i’ll redact them here.
The export shows it joining the discussion, posting “Hello from the Netherlands” at 15:14:45 CET and later asking how Ukraine was doing.
My assessment associated this account with the operator.
The preserved messages alone establish participation, however, not common control.
The displayed name, claimed location and profile photograph do not establish the identity or nationality of whoever operated it.
In particular, the person depicted in the avatar should not be identified as the attacker on that basis.
The same restraint applies to the wider chat.
It contains supporters, critics, spectators and bots.
A participant making pro-Russian comments is not automatically another account belonging to the attacker.
The access was way more serious than the performance
There is plenty to laugh at in the execution.
The access itself deserves a different assessment.
A trusted publication distributes more than text.
It provides a familiar sender, a recognizable website, established readers and accumulated credibility.
Unauthorized control over those surfaces can make false reporting appear to come from a source people already trust.
Even an obvious fabrication consumes newsroom time and leaves readers wondering which subsequent messages are genuine.
More credible disinformation delivered through the same surfaces could have caused substantially greater harm.
The materials reviewed here show crude falsehoods, Telegram promotion and claimed subscriber access, but they didn’t establish a malware operation or a broader targeted campaign (luckily).
The data-access claim also warrants attention independently of the ridiculous commentary around it.
If names, email addresses, locations and IP information were exposed as alleged, affected readers could face privacy and targeting risks.
Those fields, their completeness and any exfiltration still need confirmation.
The publisher says members and donors banking details were not at risk because third parties handle payment information.
That statement should not be stretched into a finding that no subscriber information was exposed.
The Kyiv Independent described the incident as a suspected Russian operation.
The Russian-language messaging and anti-Ukrainian hostility are visible in the preserved record.
At this point it does not establish state sponsorship or a particular intelligence service or something similar.
Likewise, similarities to the recent air-alert incident are in my opinion insufficient to attribute both attacks to the same operator.
The channel identity itself referenced Hitcore in a later argument, distinguishing an attack on an alert service from an attack on a media outlet.
What I watched was an operator turn valuable access into implausible scare messages, a Telegram advertisement and a subscriber-geography rant.
The newsroom still had a real incident to contain.
Readers still received messages they should never have received.
And somewhere in the middle of it, the hazelnuts were flying.
Evidence note:
This article draws on three emails I received, contemporaneous monitoring notes and screenshots and overlapping Telegram exports preserved on November 4-5, 2026. Telegram export timestamps explicitly use CET (UTC+01:00); email receipt and website display times are retained as recorded.
Public context comes from the Kyiv Independent’s November 4 incident statement and About page, checked on November 5. No independent validation of the claimed subscriber database or initial access method is available in this material.
