Anti-Putin cyberattack disrupts nationwide school assessments in Russia

A cyberattack targeting Russia’s nationwide school assessment systems disrupted examinations and replaced online questionnaires with anti-government messages urging students to join an underground movement against President Vladimir Putin.

The attack last Friday forced Russia’s education watchdog, Rosobrnadzor, to suspend assessments at schools and vocational education institutions across the country. Students using the agency’s Edutest platform encountered political messages on their screens instead of the questions they were expected to answer.

Rosobrnadzor recently said that it had restored its online systems after attacks targeted its digital resources and those of the Federal Institute for Education Quality Assessment (FIOKO), an organisation responsible for evaluating education standards.

The incident raised concerns about the vulnerability of digital assessment systems, as well as the use of educational platforms to spread political messages to schoolchildren.

A pro-Ukrainian hacking group calling itself Black Spark claimed responsibility for the disruption. The group describes itself as an underground resistance movement operating inside Russia and has previously claimed cyberattacks against Russian technology companies.

Ekaterina Mizulina, a pro-Kremlin activist who heads Russia’s Safe Internet League, said she had received reports from students at schools across the Moscow region who encountered the messages while completing their assessments.

“Halfway through the assessment, when they moved on to another question, the same image appeared on everyone’s screens, urging them to take part in anti-government activities,” Mizulina wrote on Telegram, sharing a photograph that appeared to show the message displayed on school computers.

The attack coincided with a major phase of Russia’s nationwide assessment programme. According to local media reports, ninth-grade students in 29 regions were scheduled to complete questionnaires as part of the exercise.

The assessments began on October 12 and were scheduled to continue until October 29. They examine several aspects of school education, including academic standards, campus safety, students’ psychological well-being, and their attitudes and values.

The programme also evaluates students’ ability to apply their knowledge in subjects and skills such as mathematics, science, reading and financial literacy.

Unlike examinations that determine individual academic performance, these assessments are designed to evaluate educational institutions. Their results do not affect students’ grades or eligibility for graduation.

Rosobrnadzor has not disclosed how the attackers gained access to the platforms or whether any data was stolen.

In a statement published on Saturday, Black Spark claimed that schoolchildren had welcomed the disruption and sent the group numerous messages of support. The group denied attempting to recruit minors into its activities.

“Under no circumstances does our movement recruit children into its activities, and we categorically oppose any attempts to involve minors in the war,” the group said.

Despite that disclaimer, the hackers urged adults to join their campaign against the Russian government, placing the cyberattack within a wider effort to challenge the Kremlin.

Black Spark has previously claimed responsibility for attacks on Russian technology infrastructure. In August, it said it had breached Russian software developer Microolap.

The company confirmed that some of its systems had been compromised but disputed the hackers’ claims that they had accessed its network monitoring platform or stolen data belonging to major Russian companies.

The latest incident highlights how cyberattacks can disrupt essential public services and turn routine school activities into channels for political messaging. While the education watchdog says its systems have been restored, questions remain over how the attackers penetrated the assessment platforms and whether safeguards are sufficient to prevent similar incidents.