Russian intelligence claims hack of former Ukrainian defence minister's phone

At 10:33 UTC on 19 July 2026, the Russian-aligned Telegram channel Two Majors published a claim that Russian security services had hacked the smartphone of Mykhailo Fedorov, the former Ukrainian Defence Minister, and extracted personal data including email addresses and phone numbers. The channel framed the operation as an intelligence coup. By mid-afternoon in Kyiv, no Ukrainian official had publicly confirmed, denied, or even acknowledged the report.

The episode is a familiar shape in this war: an unverified assertion, dressed up in the technical vocabulary of cyber operations, dropped into the information ecosystem by a Russian-aligned outlet with a record of amplifying Moscow's preferred narratives. What makes the Fedorov claim worth pausing on is the target. A serving or former minister's device is precisely the sort of prize state services trade in leaks and quiet compromises. Whether the Two Majors post reflects a real operation, recycled fabrications, or something in between is a question the public record cannot yet settle.

What Two Majors actually wrote

The post itself is short on operational detail. The channel asserts that "Russian security forces", no service named, no agency attribution, no FSB or GRU branding, broke into a smartphone belonging to Fedorov and walked away with email addresses and phone numbers. The channel does not specify when the alleged intrusion occurred, what vulnerability was exploited, whether any messaging application or cloud account was compromised, or whether the device was in Fedorov's possession at the time. Two Majors has previously carried unverified battlefield claims and intelligence-adjacent framing that the Russian defence ministry later echoes, which gives the channel reach but not reliability.

The framing inside the post is the giveaway. The claim is positioned to suggest that Ukraine's wartime digital leadership is penetrable, that the country's ministers carry exploitable devices, and that Moscow retains offensive cyber reach even as its forces grind through a war now well into its fourth year. None of those propositions is independently established by the channel's text.

Why the target matters

Fedorov ran Ukraine's Ministry of Digital Transformation before becoming Defence Minister, and was the architect of the country's wartime app ecosystem: Diia, the government services portal that became a frontline administrative tool, and the broader push to put state services on citizens' phones. A successful compromise of a senior minister tied to that portfolio would be operationally valuable. A fabricated claim that such a compromise occurred is also valuable, it primes Western intelligence customers, defence journalists, and Ukrainian officials to assume the worst.

The same channel ecosystem that amplifies battlefield claims also runs influence operations aimed at Western readers. A reader who has never heard of Two Majors and who sees the claim recycled by Russian state media outlets will struggle to distinguish a confirmed intrusion from a designed leak.

The verification gap

Western and Ukrainian cyber firms with the technical telemetry to authenticate a smartphone compromise have, as of 19 July, said nothing publicly. The SSSCIP, Ukraine's cyber and information security service, has not commented. The Ministry of Defence in Kyiv has not commented. Fedorov's public accounts are quiet. The silence cuts both ways: in past incidents, Ukrainian officials have waited days before acknowledging breaches, partly to avoid handing Moscow a propaganda win. But silence is not corroboration.

There are also reasons to be cautious about dismissing the claim outright. Russian intelligence services have a documented record of operations against Ukrainian officials' devices dating back to the pre-war period, and the targeting logic behind Fedorov is obvious. The structural incentive to publicise an intrusion that may or may not have happened is also obvious.

What this episode really measures

The episode is less a story about Fedorov's phone than about the information architecture surrounding the war. A single Telegram post from a channel with a few hundred thousand subscribers can, inside a news cycle, become "the Russians hacked the Ukrainian defence minister" in outlets that do not trace the provenance. The Western press has, on past occasions, repeated Russian-aligned claims about Ukrainian casualties, battlefield losses, and political turmoil with insufficient sourcing.

The honest reading on the available evidence is this: a Russian-aligned channel has claimed an intrusion against a senior wartime Ukrainian figure. The claim is technically plausible, operationally intelligible, and unverifiable from the public record. Until either side produces evidence, technical indicators, device forensics, or official confirmation from a verifiable source, the claim sits in a category that has grown crowded since 2022: the asserted cyber operation, floated for effect, awaiting proof.

Two dates will tell. If SSSCIP or the Ministry of Defence acknowledges a compromise in the coming days, the Two Majors claim becomes a confirmed episode in a long war of digital attrition. If the silence stretches past a week, the episode joins the larger pile of unverified Russian-aligned assertions that the information environment absorbs and forgets. Neither outcome changes the underlying contest. Both are worth tracking.

This publication treats Russian-aligned Telegram channels as counter-claim material with explicit sourcing caveats, never as a stand-alone factual basis. Ukrainian official channels, Western cyber firms, and wire services will be the test bed for any version of this story that moves from assertion to evidence.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://t.me/two_majors