Hackers breach Russia's statistics agency, claim data on war losses

Overview

Updated 1 hour ago

Russia's state statistics agency, Rosstat, said its main website and regional portals were hit by coordinated cyberattacks between Oct. 29 and Nov. 1, 2026. Visitors to the sites found a message in Belarusian: "No one will escape accountability." The logos of two hacking groups, the Belarusian Cyber Partisans and Silent Crow, were posted alongside it.

The hackers say they took 23 terabytes of files, including internal documents, census materials and data on Russian military losses in Ukraine. Rosstat says its monitoring systems caught the intrusion in time and that no databases or legally protected information leaked. Neither claim has been independently verified.

Why it matters

If the stolen files are real, Russia's own count of its war dead may become public for the first time since 2024.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

23 TB

Data volume hackers claim to have taken

Silent Crow's figure, which includes roughly 2 terabytes of documents marked for official use only. Not independently confirmed.

25,000

Computers hackers claim to have accessed

The groups say this covers Rosstat's central office, regional branches and its main statistics processing center.

4 days

Length of the attack window

Rosstat says the operation ran from Oct. 29 to Nov. 1 and was launched from multiple locations at once.

Voices

Curated perspectives — historical figures and your fellow readers.

Organizations Involved

Rosstat (Federal State Statistics Service)

Russian federal agency

Target of the attack; denies any data leak

Russia's official statistics agency, which collects and publishes demographic, economic and social data.

Silent Crow

Hacking group

Claims responsibility; designated extremist and banned in Russia

A hacking group that has claimed several high-profile breaches of Russian state and corporate systems.

Belarusian Cyber Partisans

Hacking group

Claims responsibility; designated extremist and banned in Russia

A Belarusian hacking collective that targets state and corporate systems, often in Belarus and Russia.

Timeline

January 2025 November 2026

5 events Latest: Today

Tap a bar to jump to that date

November 2026
Hackers deface Rosstat sites, claim 23 terabytes
Today Cyberattack

Belarusian-language messages and group logos appear on the agency's portals. Rosstat confirms the attack and denies any leak.
Today
October 2026
Attacks on Rosstat begin
Cyberattack

Rosstat later says the operation was carefully planned and hit several areas at once from multiple locations.
3 days ago
July 2026
Russia bans both hacking groups
Legal

The Supreme Court designates the Belarusian Cyber Partisans and Silent Crow as extremist organizations.
July 2026
July 2025
Aeroflot IT systems attacked
Cyberattack

The same two groups claim the attack, which cancelled more than 100 flights. Prosecutors opened a criminal case.
July 2025
January 2025
Silent Crow claims Rosreestr database theft
Cyberattack

The group says it took about 2 billion property-owner records. Rosstat's peer agency denied a leak, but journalists verified some published data.
January 2025

Scenarios

Investigators verify files on Russian war losses

Uncertain Resolves by Q1 2027

Discussed by: The Moscow Times and other outlets note the hackers' war-loss claim is unverified but consistent with data Rosstat once published.

Independent journalists or researchers obtain part of the claimed archive and match it against known Rosstat publications or internal document formats. If the files check out, the story shifts from a defacement to the disclosure of casualty data Russia stopped publishing in 2024.

Rosstat restores systems and the leak claim fades

Possible Resolves by Jan 31, 2027

Discussed by: Rosstat itself, which says monitoring caught the intrusion and no protected data was compromised.

The agency brings its sites back online, reports no data loss, and the hackers' 23-terabyte claim stays unproven. This follows the pattern of the Rosreestr breach, where the agency denied a leak and the story lost momentum after initial coverage.

Stolen archive surfaces for sale or publication

Possible Resolves by Q2 2027

Discussed by: Security researchers tracking the two groups, who have published stolen material after past operations.

The hackers post samples or offer the full archive to buyers, forcing Rosstat to respond to specific documents rather than a general denial. The key test is whether the material includes personnel, census or military-loss records that can be checked against outside data.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

January 2025

Rosreestr property database breach (2025)

Silent Crow claimed to have stolen a database of about 2 billion records on property owners from Rosreestr, Russia's state real estate registry. The agency denied a leak.

Then

Journalists were able to verify some of the information the hackers published.

Now

The episode set a pattern for these operations: a bold claim, an official denial, and partial outside verification.

Why this matters now

The same group is behind the Rosstat claim, and the same dispute over authenticity is playing out again.

July 2025

Aeroflot IT attack (2025)

The Belarusian Cyber Partisans and Silent Crow claimed an attack on Aeroflot's IT systems that caused widespread disruption and cancelled more than 100 flights.

Then

Russian prosecutors confirmed a cyberattack and opened a criminal investigation.

Now

The groups demonstrated they could reach large state-linked infrastructure, not just websites.

Why this matters now

It shows the Rosstat breach is part of a run of operations against Russian state and state-linked systems, not a one-off.

2024