Cherkasy-based news website 18000 received an email impersonating the Economic Security Bureau (ESB). The letter asked for the media outlet’s constituent documents, charter, tax returns, and financial reports for the past three years, 18000 co-founder Artur Chemyrys tells Yelena Shchepak, the Institute of Mass Information representative in Cherkasy oblast.
Venera Ihorivna Yutsevych, allegedly a specialist in the ESB’s inspection department, is listed as the sender.
“If the requested information is not provided in digital form by 03/20/2026, your organisation’s financial activities of will be suspended until the Economic Security Bureau of Ukraine receives the information,” the letter reads.
“We realised that this was phishing at once,” says Artur Chemyrys. “For instance, the email said we had to submit our VAT tax returns, even though our organisation is not and never was a VAT payer. The letter also came from a non-governmental domain account.”
To once again make sure that the letter was fake, Chemyrys called the number listed in the email. It turned out to be the ESB’s real number; however, the agency said that the email was a phishing attempt, and that many other companies and organisations were receiving similar ones. The news outlet was advised to contact the cyber police.
The ESB later reported the impersonation campaign on its website.
“We would like to inform you that the Economic Security Bureau of Ukraine has issued no instructions to send such letters and does not send digital requests to business entities asking them to share their constituent, financial, or tax documents in this way,” the message states.
The Economic Security Bureau added that they have already contacted the relevant law enforcement bodies.
Earlier, 18000 received several phishing emails impersonating Meta.
