Yandex worker stole search engine source code, tried selling for just $28K
Andrii Degeler / Ars Technica :
Context & Ripple Effects
The $28K source-code sale attempt is an early entry in what becomes a recurring insider problem for Yandex: five years on, the company caught an employee selling access to thousands of user mailboxes, and in 2023 a 44.7GB code repository leak was blamed on a former employee with no hack required. The pattern across these incidents is that Yandex's most valuable assets — its search codebase and user data — have repeatedly left the building through people, not perimeter breaches.
That matters because insiders were never the only vector: Reuters reporting had state-linked hackers using Regin malware inside Yandex by late 2018, so the company was defending its code and users from both directions at once.
First-order effects
- Yandex faces an internal-security reckoning over how a single worker could exfiltrate its core search source code, with the low $28K ask suggesting the seller struggled to find buyers for it.
Second-order effects
- Any buyer who did acquire the code would gain a roadmap into one of the world's largest non-English search engines — the same asset state-linked intruders reportedly sought via the Regin infiltration years later.
Third-order effects
- If insider leakage keeps outpacing external attack as the way source code escapes, large tech firms will be pushed toward tighter source-repository custody, access auditing, and employee monitoring — controls that treat trusted engineers as the primary threat surface.
The trend: For Yandex, source code and user data have proven more likely to leak through employees and former staff than through hacked systems, making insider custody the company's defining security problem.