Russia’s Federal State Statistics Service, more commonly known as Rosstat, was hit by a large-scale cyberattack overnight into Nov. 1. The agency confirmed that its systems had been breached, according to a report by the Kremlin-aligned newspaper Kommersant. Hacker groups Silent Crow and Belarusian Cyber Partisans claimed responsibility for the incident, saying they had gained access to around 25,000 computers and servers, stealing roughly 23 terabytes of data and destroying part of the agency’s internal IT infrastructure. The hackers say they have obtained information on Russian casualties in Ukraine.
Rosstat, for its part, announced that it had found no evidence that its databases were compromised or that legally protected information had been exfiltrated:
“From Oct. 29 through Nov. 1, Rosstat’s information resources were subjected to targeted destructive cyberattacks. The infrastructure functioned as designed: Monitoring systems promptly detected suspicious activity, allowing specialists to begin responding quickly.”
The agency added that information security specialists, working with law enforcement, were determining how the attackers gained access and identifying the sources of the attack. During the night of Nov. 1, the logos of the hacker groups appeared on Rosstat’s federal website and on the websites of its regional offices. The hackers also posted messages, including one in Belarusian reading, “No one will escape responsibility.” The original site was restored by morning.
What the hackers claim
Silent Crow said in a statement that the attackers gained access to the infrastructure of Rosstat’s central office, its regional branches, and its Main Interregional Center for the Processing and Dissemination of Statistical Information. The group said it obtained access to domain controllers — systems that manage user accounts and access permissions within a corporate network — as well as virtualization servers running VMware ESXi, oVirt, and zVirt.
Among the data it claims to have stolen, the group listed databases containing demographic and economic statistics, census materials, and documents marked “for official use only,” a Russian classification generally applied to sensitive but nonclassified government information. The hackers said they extracted about 2 TB of documents in that category alone. They also named several internal Rosstat information systems, including one called “Demography,” along with the agency’s electronic document management system.
Silent Crow separately said it obtained “information relating to Russian military losses during the war against Ukraine, including data contained in Rosstat systems.” The hackers did not specify what those documents contained.
What information Rosstat may hold on military losses
Rosstat does process mortality data, including deaths resulting from military operations, The Insider found. According to Rosstat’s official methodology, medical death certificates are among the sources used to determine causes of death. The listed causes explicitly include “injuries resulting from military operations.”
As early as 2019, The Insider reported that in 2018, Rosstat’s statistics included a new category tallying people killed as a result of military operations; there were four that year. A Rosstat representative said at the time that the information was received in anonymized form from Russia’s civil registry system, known as ZAGS, while the cause of death was determined by a medical institution.
In recent years, however, Russian authorities have increasingly restricted public access to demographic data. As the data journalism project Yesli Byt Tochnym (lit. “To Be Precise”) found, Rosstat stopped publishing final statistics on causes of death in 2024. Then, in 2025, many figures on births, deaths, marriages, and divorces also disappeared from public access.
Overall, at least 168 datasets disappeared from publicly available statistical collections, including information on civil servants’ salaries, social benefits, and recipients of state assistance. The removed indicators also included data that could be used to indirectly assess the consequences of the war, including the number of combat veterans and funeral payments.
The same groups previously claimed attacks on Aeroflot and Rosreestr
Silent Crow and Belarusian Cyber Partisans previously claimed responsibility for a major breach of Aeroflot’s computer systems that occurred in late July 2025. The attack caused dozens of flight cancellations and disrupted the airline’s operations. The hackers said at the time that they had spent about a year inside Aeroflot’s corporate network, stolen 22 TB of information, and destroyed thousands of servers. As The Insider reported at the time, Russia’s Prosecutor General’s Office confirmed that a cyberattack had caused the disruption and said the office had opened a criminal case under the statute covering unlawful access to computer information.
In January 2025, Silent Crow also claimed to have hacked Rosreestr, Russia’s federal property registry. The group said it gained access to a database containing 2 billion records on property owners and published about 82,000 rows containing Russians’ personal information. Rosreestr denied that a leak had occurred, but journalists from the independent outlet Agentstvo checked a random sample of 15 people and confirmed that the published information was authentic.
On July 21, 2026, Russia’s Supreme Court designated both groups as “extremist” organizations. In the court’s official statement, Silent Crow was described as a pro-Ukrainian hacking group, while Belarusian Cyber Partisans was described as an organization linked to the Belarusian opposition movement Supratsiŭ, whose name means “Resistance” in Belarusian.
The Belarusian Cyber Partisans have also previously hacked information systems belonging to Belarusian government agencies. Materials obtained in those breaches have been used in journalistic investigations.
