Surveillance tech provider Protei was hacked, its data stolen and its website defaced

A Russian telecommunications firm known for developing web surveillance and censorship technologies has reportedly suffered a significant data breach. Protei, which has its roots in Russia but is currently based in Jordan, provides telecom systems to various countries, including Bahrain, Italy, Kazakhstan, Mexico, Pakistan, and regions across central Africa. The company specializes in video conferencing solutions, internet connectivity, and surveillance equipment, including deep packet inspection systems that facilitate internet filtering. While the exact timeline and method of the breach remain unclear, it was noted that the company's website was defaced on November 8, as documented by the Internet Archive’s Wayback Machine. The site was restored shortly thereafter. During the cyber incident, the hacker accessed approximately 182 gigabytes of data from Protei’s web server, which includes years' worth of emails. A portion of this data was handed over to DDoSecrets, a non-profit organization committed to transparency, which catalogs leaked datasets for public interest, including those from law enforcement and surveillance entities. Despite attempts to reach out, Mohammad Jalal, the managing director of Protei’s Jordan branch, has not commented on the breach. The identity and motivations of the hacker remain unidentified, although a message left on the defaced site stated, “another DPI/SORM provider bites the dust.” This likely alludes to Protei's involvement in providing deep packet inspection systems and technology linked to SORM, a lawful intercept system utilized in Russia and other nations that employ Russian technology. SORM enables phone and internet providers to install equipment that allows governments to access the content of calls, messages, and browsing activities. The deep packet inspection tools developed by Protei enable telecom companies to monitor and filter web traffic based on its origin, permitting selective blocking of content. Such systems have raised concerns regarding surveillance and censorship in areas where freedom of expression is restricted. Additionally, a report from Citizen Lab in 2023 indicated that Iranian telecom company Ariantel had engaged with Protei for technology aimed at monitoring internet traffic and restricting access to specific websites, highlighting the company’s capabilities in targeting individuals or broad populations.