Rosstat hack: what is claimed and what is confirmed
On 1 November 2026, two hacker groups, Ukraine's Silent Crow and Belarus's Cyber Partisans, said they had broken into Rosstat, Russia's federal statistics service, taken its data and destroyed its internal IT infrastructure. Rosstat publishes the official figures on Russia's economy, population and census.
Rosstat confirms it has been under attack since 29 October, but denies that any data leaked. Most of what follows comes from the attackers themselves and has not been independently verified.
What the hackers claim
According to Silent Crow's statement, the groups controlled about 25,000 machines across Rosstat's central office, its regional branches and its main data processing centre. They say they held the domain controllers in all three, along with the systems that run Rosstat's virtual servers: zVirt, oVirt and VMware ESXi.
From there, they say, they downloaded:
- the electronic document management system, with the agency's internal correspondence;
- Rosstat's core statistical systems, including its demography system;
- about 2 TB of documents from a restricted network for papers marked "for official use only";
- databases with economic and personal data, census materials, and the contents of employees' computers.
Silent Crow puts the total at about 23 TB. Cyber Partisans give a figure of more than 10 TB and say they wiped databases, servers, the virtualization environment, document management, workstations and the VPN, Brandefense reports.
The loudest claim is about the war. The groups say the data includes Russia's real military losses in its war against Ukraine, figures the Kremlin does not publish. They haven't released those numbers yet and promise to publish part of the data later.
What is confirmed
Rosstat says it recorded attacks on its resources from 29 October to 1 November. Its website went down, and federal and regional pages showed both groups' logos with a line in Belarusian: "No one will escape accountability", LB.ua reports.
Rosstat told Kommersant that its infrastructure is working normally, and that it found no compromise of its databases and no leak of legally protected information. It has not said how the attackers got in. No outside party has yet confirmed the number of machines, the volume of data or the wipe.
Not the first time
The same two groups claimed the attack on Aeroflot in July 2025. They said they had been inside the airline's network for a year and destroyed more than 7,000 servers and workstations. Aeroflot cancelled more than 100 flights, and Russian prosecutors confirmed a cyberattack, Security Affairs reported. In July 2026, Russia's Supreme Court declared both groups extremist organizations.
What it shows
The Aeroflot and Rosstat claims follow the same pattern: months of quiet access, then the domain controllers and the virtualization layer, then everything at once. Whoever holds the domain controllers holds every account. Whoever holds the hypervisors holds every server that runs on them, including any backups that live there.
That is why a backup only counts if it sits outside the systems and accounts it protects. If the wipe claims are true, how fast Rosstat recovers comes down to whether it kept such a copy.
So make backups. Unless, of course, you're Russian.
Facts checked on 1 November 2026.