Hackers Claim to Have Breached Rosstat and Stolen 23 TB of Data on Russian Army Losses

Belarusian Cyber Partisans and the pro-Ukrainian hacking group Silent Crow have claimed responsibility for a large-scale breach of Rosstat, allegedly gaining access to 25,000 computers and servers and stealing approximately 23 TB of data. According to the hackers, the stolen materials include classified information about Russian military losses in Ukraine that Moscow does not disclose in its publicly available statistics.

The hacking groups reported breaching the infrastructure of Russia’s Federal State Statistics Service (Rosstat) and gaining access to internal documents, databases, and administrative systems. Some of the stolen materials are allegedly marked “For Official Use Only,” while other files, according to the attackers, contain state secrets. In addition to stealing information, the hackers claimed to have destroyed part of the agency’s internal IT infrastructure. Rosstat confirmed that cyberattacks had taken place but denied that its databases had been compromised. The reported scale of the data breach has not been independently verified.

Hackers Claim Access to Classified Military Casualty Statistics

One of the main targets of the attack was documents that could contain actual figures on Russian military personnel killed in Ukraine. Rosstat processes population mortality statistics, including deaths resulting from combat operations. Its classification of causes of death also includes injuries sustained during military operations. However, in 2024, Russia stopped publishing annual cause-of-death statistics, significantly reducing the amount of publicly available data that could be used to estimate the number of soldiers killed in the war.

Following the attack, the Cyber Partisans shared a chart showing monthly Russian military losses reaching 50,000 personnel. However, it has not been confirmed that these figures originated from Rosstat’s internal documents. There is also no evidence that all the losses shown in the chart refer exclusively to soldiers killed rather than overall personnel losses.

According to data released by the General Staff of the Armed Forces of Ukraine on November 3, Russia has lost approximately 1,594,830 military personnel since the beginning of its full-scale invasion in February 2022. Ukrainian military officials estimated an additional 2,060 Russian personnel losses over the previous 24 hours. These figures represent estimates of overall personnel losses, not exclusively fatalities, and therefore cannot automatically substantiate the mortality statistics the hackers claim to have obtained from Rosstat.

The Belarusian Cyber Partisans reported on X that they had managed to extract more than 10 TB of data, including documents and databases with restricted access.

“More than 10 TB of data extracted. Documents. Databases. Everything, including materials classified as state secrets. We don’t just hack their systems. We read their secrets.”

Meanwhile, Silent Crow estimates the total volume of stolen data at approximately 23 TB. The hackers also claim to have gained access to the infrastructure of Rosstat’s central office, its regional branches, and the Main Interregional Center for Statistical Information Processing and Dissemination. According to the attackers, they managed to compromise domain controllers responsible for managing employee accounts and access permissions within the corporate network.

The hackers also allegedly gained control of virtualization servers running VMware ESXi, oVirt, and zVirt. These platforms allow multiple virtual servers to run on a single physical machine, meaning their compromise could affect a large number of internal services simultaneously. The Cyber Partisans also claimed to have disabled several of the agency’s systems.

“Destroyed systems: STATEK, CSOD, Demography, SED, ESSO, OFSN, internal employee surveillance, StatRegister, websites, and others.”

These claims about the destruction of infrastructure have not been independently verified.

On November 1, the logos of the Belarusian Cyber Partisans and Silent Crow appeared on Rosstat’s federal website and the websites of its regional branches. In some messages posted on the compromised resources, the hackers left a statement in Belarusian declaring that no one would escape accountability. At the time of the original publication, Rosstat’s main website was still displaying a temporary unavailability notice. The attack therefore affected not only the agency’s internal systems but also its public-facing websites.

Rosstat Acknowledges Cyberattack but Denies Data Breach

In a statement to the Russian newspaper Kommersant, Rosstat representatives confirmed that the agency had been subjected to targeted cyberattacks over several days.

“From October 29 to November 1, Rosstat’s information resources were subjected to targeted destructive cyberattacks. The infrastructure operated as intended: monitoring systems promptly detected suspicious activity, allowing specialists to quickly begin responding.”

However, the agency maintains that its databases were not compromised and that protected information did not fall into unauthorized hands. This position contradicts the hackers’ claims of a massive data breach and the destruction of internal systems. Until the allegedly stolen materials undergo independent verification, the actual extent of the compromise cannot be determined.

Russia Is Gradually Concealing Statistics That Could Reveal the Consequences of the War

The Rosstat breach comes amid Russia’s gradual restrictions on public access to government statistics. As reported by The Insider, dozens of datasets have already disappeared from publicly available statistical reports, making it harder to assess the country’s demographic and socioeconomic situation. These include information on the salaries of civil servants, healthcare workers, and educators, as well as household spending and government social assistance.

The restrictions have also affected data on the number of recipients of government benefits, including combat veterans. Certain indicators related to birth rates, mortality, and funeral payments have also stopped being published or updated. Such statistics can indirectly reveal the consequences of the war, including the number of veterans, the scale of mortality, and government spending on compensation for the families of fallen soldiers.

According to The Insider, access to additional indicators covering births, deaths, marriages, divorces, and social benefits may also be restricted in 2027. This makes the potential leak of Rosstat’s internal databases particularly significant, as they may contain information that Russian authorities no longer make public.

Both hacking groups have previously claimed responsibility for major cyberattacks against Russian government agencies and commercial organizations. Silent Crow is known for operations targeting Russia and its allies, while the Belarusian Cyber Partisans regularly attack the information systems of Lukashenko’s regime and Russian organizations.

In July 2025, the groups claimed responsibility for a major cyberattack on Russian airline Aeroflot, which caused serious disruptions to its IT infrastructure. According to experts, a significant portion of the airline’s internal systems was at risk. Both groups have been designated as extremist organizations in Russia.

The latest attack on Rosstat could prove far more significant than an ordinary government website breach. If the hackers genuinely obtained internal mortality statistics and military casualty records, these documents could help establish the scale of Russian military losses. For now, however, only the cyberattack itself has been confirmed, while claims that 23 TB of data were stolen remain unverified.