Lawyer hackers: how the scheme of hacking the state register of court decisions operated

The National Anti-Corruption Bureau of Ukraine (NABU) has charged three lawyers from the law firm "Guarantee of Your Rights," who are accused of systematically illegally interfering with the work of the Unified State Register of Court Decisions (USRQD). The case involves the actual head of the firm, Dmytro Borzykh, a former assistant to the chief military prosecutor Anatoliy Matios.

This was reported by "Hlavkom."

According to the investigation, the lawyers, including Borzykh, obtained unauthorized access to the materials of at least 100 criminal cases, about 30 of which related to NABU’s cases on top-level corruption. Most of the lawyers at "Guarantee of Your Rights" are former employees of the military and general prosecutor’s office.

In 2020, they created their own law firm, and by 2022, as stated in the case materials, they began using "exclusive" methods of client protection—through the hacker Kostyantyn Saybel. In 2019, he received a suspended sentence in a case investigated by the future lawyers. Subsequently, he hacked state registers and extracted confidential information, including data on the movements of the head of the Defence Intelligence of Ukraine.

The case involves prominent names: Ihor Kolomoiskyi (oligarch), Borys Kaufman (Odesa developer), Dmytro Isayenko (former official of the Ministry of Regional Development, developer), Bohdan Yakymets (associated with "servicing" top corruption cases), Oleksandr Nasikovskyi (co-owner of DIM Group), Oleksandr Hranovskyi (former MP, businessman from Poroshenko’s circle), Kyrylo Shevchenko (former head of the National Bank of Ukraine, wanted), Vadym Novynskyi (former MP, former shareholder of "Metinvest," associated with the Ukrainian Orthodox Church of the Moscow Patriarchate).

NABU Investigation

NABU considered several versions of the source of the information leaks. As part of one of them, by court order, listening devices were installed in the company’s office. Operational measures continued from mid-November to the end of December 2023, with all events in the office being recorded in real-time.

However, the actions had to be halted early: after a scandal arose around the eavesdropping of Valeriy Zaluzhnyi’s office, the suspects became cautious and called in technical specialists. This forced the detectives to act sooner. Searches were conducted in the office and residences of several lawyers, as well as at the hacker Kostyantyn Saybel’s. Electronic devices, including phones and laptops of Saybel and lawyer Andriy Filyuk, were seized. According to the publication’s sources in the National Police, in September 2023, Saybel left Ukraine.

The investigation lasted for a year and a half. After the recent announcement of suspicions, there was a version that NABU had been under pressure from the Office of the President the whole time and allegedly deliberately pursued the "least severe article," although the recordings, made during a month and a half of surveillance, contained grounds for much more serious accusations. From the beginning, two criminal cases were opened against Dmytro Borzykh and his accomplices under the following articles of the Criminal Code of Ukraine:

• obtaining undue advantage by officials (Part 3, Article 28, Part 3, Article 368);
• interference with the work of automated court documentation circulation systems (Part 2, Article 376-1).

Both criminal cases were combined by the prosecutor, so the "Borzykh case" is under NABU’s jurisdiction. The suspects’ lawyers are trying to appeal this. Bribery investigations require more resources than NABU has—at least ten detectives and long-term operational work, according to publication sources.

Two investigations were conducted in parallel. After the early completion of the operation and seizure of equipment, the investigation collected enough evidence to charge three individuals for interfering with the USRQD. Other episodes, including those regarding corruption, are still under investigation.

According to the publication’s sources in law enforcement, during the investigation, signs of bribe preparation were recorded—judges and experts, in order to obtain conclusions which could serve as grounds for an acquittal. These facts resulted in a separate case being opened, which was later combined with the main case. After Oleksandr Ruvin resigned from the position of head of KNDISE, Borzykh retained influence there. According to sources, his team continued a scheme of selling expert reports.

Data Analysis

The full scheme of digital intervention in the USRQD was only restored by the investigation in mid-2024—after laptops of the involved parties were hacked. Only after multiple analyses of the audio recordings and actions within the register was it possible to determine: who coordinated the scheme, who carried out actions, how data was transferred, and what impact it had.

In January, investigators seized additional evidence from a provider—on its server, they found a fragment of the digital infrastructure. Despite some lost data, it was possible to restore the operation of the BAS script—an automated platform for accessing the USRQD. The system worked both with the hacker and on the server, using the login and electronic key of one of the judges, supposedly—Vasyl Voloshyn from the Shevchenkivskyi court of Kyiv.

The judge denies his involvement. The investigation needs to determine whether he provided access to outsiders or if the key was compromised in another way.

"The access mechanism was honed to perfection. The hacker supervised the system daily, manually updated it, and installed a Telegram bot that allowed searching for court decisions by key words. Authorization occurred through a proxy server abroad: the request was sent to the register, the necessary decision opened and was returned to the user," the material states.

From lawyer Andriy Filyuk’s laptop, law enforcement determined that each user of the bot had access to court cases by surname, number, or key words. The system automatically searched and returned full texts of decisions, updating every 12 hours. Over a year and a half, it processed over 10,000 decisions.

Investigators recorded over 600 incidents of targeted searches, in total—over 39,000 queries and access to over 7,500 court rulings. On certain days, the number of unauthorized actions in the register exceeded 1,000. Lawyers monitored not only decisions regarding searches or arrests but also temporary accesses, preventive measures—in all types of proceedings. The priority was top-corruption cases.

On Filyuk’s computer, over 600 illegally downloaded decisions were stored. According to publication sources, Dmytro Borzykh coordinated all activities—it was he who set tasks without directly intervening in the system.

Although the listening ended back in December 2023, the examination was assigned only in November 2024. Initially, the recordings were sent for phonoscopic examination to the Ministry of Internal Affairs’ Center for Forensic Examinations, but due to technical incompatibility of the firmware, experts could not provide a clear conclusion. In January 2025, the case was transferred to the Lviv Institute of Forensic Examinations. Lviv experts acknowledged the recordings as authentic. This laid the groundwork for further investigative actions. From the time of the 2023 operation, the scheme’s operation has been effectively blocked.

"The Law Firm Continues to Operate"

Despite the charges, the law firm continues to operate, maintaining influence in the courts. Dmytro Borzykh, released on a 10 million UAH bail, openly boasts about connections in NABU, which supposedly "resolve issues."

Although there is public data on the lawyers’ involvement in corruption and unauthorized access to registries, the National Bar Association not only has not initiated any disciplinary proceedings but has also defended the accused, initiating a case against NABU detectives.

According to publication sources, Borzykh’s office was even visited by Deputy Prosecutor General Ihor Mustetsa. At one time, Borzykh and Matios appealed to KDAC head Pavlo Vovk to retain their positions in the military prosecutor’s office. Matios also helped Borzykh avoid liability for inaccurate declarations by allowing him to correct data in the declaration.

The publication emphasizes that although Matios now conducts a modest advocacy practice in Lutsk, he maintains close ties with the OPU. Borzykh himself, according to sources, had contacts on Bankova with ex-deputy heads of the OPU, Smyrnov and Kuleba.