---
title: "Operation \"Postman\": How Russia Uses Stolen Ukrainian Data to Attack Government Agencies"
description: "RBC-Ukraine has revealed the Russian operation \"Postman\": since May 2026, Ukrainian government bodies have been receiving a mass of fabricated complaints created on the basis of stolen personal data of citizens. According to the outlet, the operation involves IPO units, the GRU, and the FSB."
date: 2026-09-01T04:10:00.000Z
lang: en
url: https://xab.info/en/posts/operation-postman-russia-attack-on-ukraine-government-agencies
tags: [ukraine, russia, cyber-operations, personal-data, information-warfare, gru, fsb, government]
publisher: "XAB.info"
---

# Operation "Postman": How Russia Uses Stolen Ukrainian Data to Attack Government Agencies

![Schematic illustration of Operation Postman: a hooded hacker, maps of Ukraine and Russia, stacks of documents, and electronic citizen appeals](https://xab.info/media/2026/09/01/operatsiya-pochtalon-rossiya-ataka-na-gosorgany-ukrainy/operatsiya-pochtalon-rossiya-ataka-na-gosorgany-ukrainy-1.webp)

## 🎯 Key Points

- Since May 2026, fabricated appeals with a single stylistic "handwriting" have been systematically reaching Ukrainian government bodies
- The applicants in the letters use other people's names and mismatched mailboxes, indicating the use of stolen personal data
- According to RBC-Ukraine, the "Postman" operation is coordinated by IPO units of the Russian Armed Forces, the GRU, and the FSB
- The mechanics of the operation exploit the legal mechanism of electronic citizen appeals, which does not require a qualified electronic signature
- Former Deputy Head of the DIU Ilya Pavlenko calls the method a classic intelligence technique with digital tools

Since May 2026, a wave of systematic appeals has been arriving at the electronic addresses of Ukrainian government bodies, law enforcement agencies, and military departments. At first glance, they look like ordinary citizen complaints. However, a detailed analysis of the mass of letters has revealed signs of a coordinated information operation that, according to RBC-Ukraine, Russian intelligence services are carrying out under the codename "Postman." Ukrainian journalists claim that the operation involves information-psychological operations (IPO) units of the Russian Armed Forces, the GRU, and the FSB. In this case, the target of the attack is not the mass audience but the Ukrainian state system itself — through the legal mechanism for receiving citizen appeals.

### A Single "Handwriting" in Hundreds of Letters

The structure of the incoming appeals demonstrates a striking stylistic uniformity. After the word "STATEMENT" comes a description of the problem and a lengthy conclusion about the threat to the state and society. This is followed by the standard phrase "I have no other way... except to turn to you," and then an identical formulation: "Pursuant to the Law of Ukraine 'On Appeals of Citizens,' I REQUEST." The letter ends with a list of demands to the authorities and a request to report the outcome in writing to the specified email address. For people of different ages, professions, from different regions, and with fundamentally different problems, such stylistic similarity is an anomaly pointing to a single author or a group of authors.

### Other People's Names and Other People's Mailboxes

The key authenticity indicator that falls apart in these letters is the mismatch between the stated name of the applicant and the contact email address. For example, an appeal in the name of "Sviatoslav Podlensky" was sent from a mailbox registered under the name of "Vera Savelyeva." A statement from "Stanislav Karpenko" also came from the same mailbox. Such anomalies are repeated in a significant part of the mass, indicating the use of compiled or stolen personal data to create fictitious "applicants."

### The Mechanics of the Operation: From Database to Legal Letter

According to RBC-Ukraine, the mechanics of "Postman" are built around a perfectly legal tool — the citizen's right to appeal to government bodies in electronic form. The Law of Ukraine "On Appeals of Citizens" does not require a qualified electronic signature for such an appeal: it is enough to specify the name, place of residence, the essence of the question, and a contact address. Officials are obliged to consider a properly formatted appeal and provide a response. In the first stage of the operation, Russian operatives form a pool of "applicants," collecting personal data from open sources, database leaks, hacked accounts, and documents previously submitted by citizens through inadequately protected channels. In the second stage, they track resonant stories already present in the information space — the explosions at warehouses in Vishnove, the destruction of a gas station in Sumy Oblast, pressure on enterprises, the alleged poisoning of Lindsey Graham — and use them as the basis for preparing complaints that do not require the creation of a complex legend.

### "They Used to Copy Data at Cemeteries"

Former Deputy Head of the Directorate of Intelligence of the Ministry of Defense, Major General Ilya Pavlenko, characterizes this method as a classic intelligence technique that has acquired modern digital tools. "In the past, intelligence officers drove around cemeteries and copied the data of the deceased in order to act in the names of real people. Now the Russians find all the necessary information on the internet," he explains. According to him, recruiting hundreds of people to write such complaints is extremely difficult, so it is much easier to use a person's identity without their knowledge or to construct a credible applicant based on real personal data, an appeal from which cannot simply be ignored.

### Contradictory Data

It should be noted that the detailed attribution of the "Postman" operation to specific structures — IPO units of the Russian Armed Forces, the GRU, and the FSB — is based on the RBC-Ukraine investigation. None of the Russian structures confirms or denies the existence of such an operation. Independent verification of the involvement of precisely these agencies is not presented in open sources at the time of publication. Moreover, the exact volume of the mass of letters, as well as the full list of government bodies affected, has not been disclosed publicly: RBC-Ukraine refers to "hundreds of appeals," but no specific figure is given. Thus, the fact of a coordinated campaign using other people's personal data is confirmed by the analysis of the letters' structure, while the exact organizational structure of the operatives remains at the level of a journalistic investigation by a single outlet.

### What This Means for the Ukrainian State

Operation "Postman" represents a new vector of information pressure: instead of influencing public opinion through the media, the adversary attacks the administrative resources of the state, forcing it to spend time and personnel processing deliberately fabricated appeals. At the same time, information noise is created around resonant events, which may hinder the real work of investigative and supervisory bodies. For citizens whose data is used without their knowledge, the situation is complicated by the fact that they may be drawn into an "investigation" over an appeal they never wrote. Experts recommend that Ukrainian government bodies implement additional verification mechanisms for electronic appeals and enhanced analytics for stylistic and structural anomalies in incoming letters.

## 🔍 Fact-Check Verification

- [Special Operation "Postman": Russia Launches a Large-Scale Information Attack Against Ukraine](https://www.rbc.ua/ukr/news/spetsoperatsiya-pochtalon-rosiya-pochala-1788182216.html) - Единственный источник. Подтверждает факт массовых сфабрикованных обращений, их стилистическую униформность, несоответствие имён и почтовых ящиков, а также называет операцию «Почтальон». Атрибуция к ИПСО/ГРУ/ФСБ — журналистское расследование RBC, не подтверждено другими источниками. Цитата генерала Павленко приведена в тексте источника.

## ❓ FAQ

### Q: What is the "Postman" operation?
**A:** According to RBC-Ukraine, it is a coordinated Russian information operation in which fabricated citizen appeals, created on the basis of stolen or constructed personal data, are mass-sent to Ukrainian government bodies. The operation has been ongoing since May 2026.

### Q: How do the Russians obtain Ukrainian personal data to create fictitious applicants?
**A:** According to the outlet, the data is collected from open sources, database leaks, hacked accounts, and documents that citizens previously transmitted through inadequately protected channels. Major General Ilya Pavlenko compares this to the former practice of intelligence officers who copied data at cemeteries.

### Q: Why is it difficult to ignore such appeals?
**A:** The Law of Ukraine "On Appeals of Citizens" obliges government bodies to consider properly formatted electronic appeals and provide a response to them. An appeal is considered anonymous and not subject to consideration only if its author cannot be identified. The fabricated letters are formatted so as to formally comply with the requirements of the law.

### Q: What topics are used in the fabricated appeals?
**A:** Russian operatives track resonant events already present in the information space: the explosions at warehouses in Vishnove, the destruction of a gas station in Sumy Oblast, pressure on enterprises, the alleged poisoning of Lindsey Graham. This allows them not to create a complex legend for each letter.

### Q: Has the involvement of the GRU and FSB in the operation been confirmed?
**A:** The attribution of the operation to IPO units of the Russian Armed Forces, the GRU, and the FSB is based on the RBC-Ukraine investigation. None of the Russian structures confirms the existence of such an operation, and independent verification of the involvement of precisely these agencies in open sources is absent at the time of publication.