Hacktivist groups Belarusian CyberPartisans and Silent Crow have claimed to steal 23 terabytes of data from Russia's Federal State Statistics Service (Rosstat), including sensitive figures on Russian military casualties in Ukraine marked "for official use only". The Russian statistics agency has acknowledged being hit by coordinated cyberattacks between October 29 and 31, but has denied claims that tens of terabytes of data were leaked.
The groups announced the breach on November 1, stating they had wiped Rosstat's IT infrastructure, including domain controllers, databases, and internal systems. A follow-up post detailed the systems they claim to have destroyed: "STATEK, CSOD, Demography, SED, ESSO, OFSN, internal employee surveillance, StatRegister, websites and more." The Rosstat website was reportedly defaced with hacker messages and logos and remains inaccessible at the time of writing.
Rosstat, which stopped publishing its annual cause-of-death statistics in 2024, functions similarly to the US Census Bureau or the UK's Office for National Statistics. A chart shared by the hacking groups using data from the claimed leak suggests that between 25,000 and 50,000 Russian soldiers have been killed every month over the last two years, with the October 2026 figure just under 50,000 if the data leak is genuine.
The Belarusian CyberPartisans have promised to share more sensitive information from Rosstat after they have picked through it. According to the report, both groups have been designated as extremist and are banned in Russia. The groups have claimed responsibility for the disruptive Aeroflot IT systems hack and a hack of a Russian state real estate company, both in 2025.
Analysis
Why This Matters
- If verified, the data could provide the first significant independent confirmation of Russian military casualty figures since Rosstat stopped publishing its own statistics.
- The attack demonstrates the persistent vulnerability of Russian state infrastructure to politically motivated hacktivist groups.
- The casualty figures presented, if accurate, could influence public and political perception of the war within Russia and internationally.
Background
Rosstat is Russia's primary agency for collecting and publishing official statistical data. Following the invasion of Ukraine, the agency restricted access to certain information, including military mortality statistics. The Belarusian CyberPartisans are a hacktivist collective opposed to the Belarusian government, active in targeting Russian and Belarusian state infrastructure since 2022. Together with the group Silent Crow, they have been designated as extremist organisations by Russian authorities.
Key Perspectives
Hackers (Belarusian CyberPartisans and Silent Crow): Claim to have successfully exfiltrated 23TB of data from Rosstat, including Ukrainian war casualty figures marked for official use, and to have destroyed the agency's entire IT infrastructure.
Russian Federal State Statistics Service (Rosstat): Confirms it suffered coordinated cyberattacks between October 29 and 31, but officially denies the claims that tens of terabytes of data were stolen.
What to Watch
- Whether the hackers release further documentation from the alleged data cache to substantiate their claims.
- Independent verification of the data by cybersecurity or intelligence analysts.
- Any retaliatory cyber operations launched by Russian state-aligned groups.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedHackers say they stole 23TB from Russia’s statistics agency.Latest from Tom's Hardware: “Hackers claim to have stolen 23TB of data from Russian statistics body”
- SupportedBelarusian CyberPartisans and Silent Crow say they obtained 23TB of data, including Russian war casualty figures.Latest from Tom's Hardware: “the hackers say that the huge new 23TB data haul includes data on Russian wartime losses marked “for official use only,””
- SupportedThe groups say the claimed data includes Russian military casualty figures marked “for official use only.”Latest from Tom's Hardware: “the hackers say that the huge new 23TB data haul includes data on Russian wartime losses marked “for official use only,””
- SupportedRosstat acknowledged coordinated cyberattacks on its servers between October 29 and 31 and denied that tens of terabytes of data had been leaked.Latest from Tom's Hardware: “Rosstat) admitted that its servers were hit by coordinated cyberattacks between October 29 and 31. However, it denied claims that tens of terabytes of data had been leaked”
- SupportedThe groups announced the breach on November 1 and said they had wiped Rosstat’s IT infrastructure.Latest from Tom's Hardware: “Today @cpartisans and SilentCrow took down Russia's Federal State Statistics Service”
- SupportedA follow-up post listed the systems the groups said they destroyed: “STATEK, CSOD, Demography, SED, ESSO, OFSN, internal employee surveillance, StatRegister, websites and more.”Latest from Tom's Hardware: ““Systems destroyed: STATEK, CSOD, Demography, SED, ESSO, OFSN, internal employee surveillance, StatRegister, websites and more.””
- SupportedRosstat’s website was reportedly defaced with hacker messages and logos and remained inaccessible at the time of writing.Latest from Tom's Hardware: “The Rosstat website was reportedly defaced with hacker messages and logos. Rosstat remains inaccessible at the time of writing.”
- SupportedA chart shared by the groups indicates that between 25,000 and 50,000 Russian soldiers were killed each month over the last two years.Latest from Tom's Hardware: “A chart indicates that over the last two years, between 25,000 and 50,000 Russian soldiers were killed every month.”
- SupportedThe chart’s October 2026 figure is just under 50,000, if the data leak is genuine.Latest from Tom's Hardware: “The October 2026 figure is just a smidgen under 50,000, if this data leak news is genuine.”
- SupportedThe Belarusian CyberPartisans promised to share more sensitive information from Rosstat after examining it.Latest from Tom's Hardware: “the Belarusian CyberPartisans promising to share more sensitive information from Rosstat after they have picked through it.”
- SupportedBoth groups have been designated extremist and banned in Russia, according to the report.Latest from Tom's Hardware: ““Both groups are designated as extremist and banned in Russia,” notes the report.”
- SupportedThe groups claimed responsibility for the disruptive Aeroflot IT systems hack and a hack of a Russian state real estate company, both in 2025.Latest from Tom's Hardware: “These same hacking groups have claimed responsibility for the likes of the disruptive Aeroflot IT systems hack, and a state real estate company hack with two billion records, both in 2025.”
