Russian television anchor Pavel Lobkov was in the studio getting ready for his show when jarring news flashed across his phone: Some of his most intimate messages had just been published to the web.
Days earlier, the veteran journalist had come out live on air as HIV-positive, a taboo-breaking revelation that drew responses from hundreds of Russians fighting their own lonely struggles with the virus. Now he'd been hacked.
"These were very personal messages," Lobkov said in a recent interview, describing a frantic call to his lawyer in an abortive effort to stop the spread of nearly 300 pages of Facebook correspondence, including sexually explicit messages. Even two years later, he said, "it's a very traumatic story."
Putin looks on during the Tsentr-2015 strategic headquarters military exercises. Photo from Russian Kremlin.
Maria Titizian, an Armenian journalist, immediately found significance in the date she was targeted: June 26, 2015.
"It was Electric Yerevan," she said, referring to protests over rising energy bills that she reported on. The protests that rocked Armenia's capital that summer were initially seen by some in Moscow as a threat to Russian influence.
Titizian said her outspoken criticism of the Kremlin's "colonial attitude" toward Armenia could have made her a target.
Eliot Higgins, whose open source journalism site Bellingcat repeatedly crops up on the target list, said the phishing attempts seemed to begin "once we started really making strong statements about MH17," the Malaysian airliner shot out of the sky over eastern Ukraine in 2014, killing 298 people. Bellingcat played a key role in marshaling the evidence that the plane was destroyed by a Russian missile — Moscow's denials notwithstanding.
The clearest timing for a hacking attempt may have been that of Adrian Chen.
On June 2, 2015, Chen published a prescient expose of the Internet Research Agency, the Russian "troll factory" that won fresh infamy in October over revelations that it had manufactured make-believe Americans to pollute social media with toxic rhetoric.
Eight days after Chen published his big story, Fancy Bear tried to break into his account.
Chen, who has regularly written about the darker recesses of the internet, said having a lifetime of private messages exposed to the internet could be devastating.
"I've covered a lot of these leaks," he said. "I've seen what they could do."