Hackers claim to have stolen 23TB of data from Russian statistics body, including Ukraine war casualty figures

Rosstat is Russia’s Federal State Statistics Service. It is a civilian agency that produces official statistics about the country. The article compares it with the U.S. Census Bureau, the Bureau of Labor Statistics, and the UK’s Office for National Statistics. Its work helps describe Russia’s population, economy, and society.

The article specifically mentions cause-of-death statistics, demographic systems, and information connected to wartime losses. Hackers also claimed access to systems named Demography and StatRegister. Those systems suggest the agency holds broad records about people, households, and national administration.

Rosstat is not a military organization, but its databases may still contain sensitive information. The article says it stopped publishing annual cause-of-death statistics in 2024. That makes the hackers’ claim about wartime-loss files especially significant, although Rosstat denied that tens of terabytes had been leaked. The agency’s website remained inaccessible when the report was written.

The Belarusian CyberPartisans and Silent Crow claim they extracted 23TB of data from Rosstat. They say the haul includes sensitive Russian wartime-loss information marked “for official use only.” Rosstat acknowledged coordinated attacks but denied that tens of terabytes had been leaked. The size and contents therefore remain disputed.

A terabyte is a large digital-storage unit. Using decimal storage, 23TB equals about 23 trillion bytes, or 23,000 gigabytes. That could represent an enormous collection of databases, documents, backups, images, logs, and system files. The exact number of individual records cannot be known from the article.

The number matters because a haul that large could potentially expose many kinds of government information, not just one casualty database. However, size alone proves neither authenticity nor importance. Investigators would still need to establish whether the files came from Rosstat, whether they are complete, and whether the casualty figures are genuine.

Verifying the claim would require more than screenshots or a striking chart. Investigators would need original files, metadata, database structures, timestamps, and other technical traces showing that the material came from Rosstat. They would also need to confirm that the files were not altered after theft or selectively presented.

A useful test would compare the alleged records with Rosstat’s known systems, naming conventions, publication history, and internal documents. Digital-forensics experts could examine hashes, access logs, and the attackers’ evidence. Independent analysts should reproduce the calculations behind the chart and check whether the monthly totals match the underlying records.

The article does not describe such verification, so the casualty figures remain claims. Stronger confidence would come from several independent sources reaching the same result. That might include official documents, credible intelligence assessments, or corroborating demographic evidence. Until then, Rosstat’s admission of an attack confirms an incident, not the alleged 23TB disclosure or its contents.

The chart could dramatically change how observers understand the human cost of the Ukraine war. It indicates that between 25,000 and 50,000 Russian soldiers were killed each month over the previous two years. If accurate, those losses would point to an exceptionally intense and costly conflict.

The article highlights an October 2026 figure just below 50,000. Maintaining the stated range for a year would imply roughly 300,000 to 600,000 deaths, although the article does not independently confirm the chart or explain its counting method. The figures could therefore affect judgments about battlefield pressure, force replacement, and the scale of Russia’s military challenge.

The impact would depend on verification. A genuine dataset could provide Ukraine and its supporters with valuable intelligence and a clearer measure of Russian losses. A misleading or incomplete chart could distort public understanding. For now, the data remains part of a developing story, and the hackers say they will publish more material after reviewing it.

The article reports two important changes: Rosstat stopped publishing annual cause-of-death statistics in 2024, and hackers say some wartime-loss data was marked “for official use only.” It does not give an official explanation for either decision. Therefore, the reason cannot be established from the article alone.

In general, governments may restrict wartime casualty information because it can reveal military losses, expose operational problems, or affect public confidence. Cause-of-death figures can also become politically sensitive when they show deaths linked to a conflict. Limiting access can reduce public scrutiny and control which figures circulate.

Those are general possibilities, not confirmed motives in this case. The article’s evidence is that publication stopped and the hackers claim to have found restricted files. If the alleged records are authentic, they could fill an information gap created by the missing public statistics. If they are not authentic, the gap still makes independent verification especially important.

A civilian statistics agency can hold information that affects military intelligence and national decision-making. Population records, demographic data, deaths, and alleged wartime losses may help outsiders assess the scale of a conflict. Destroying systems can also interrupt reporting, administration, and access to official records.

The hackers claimed they wiped domain controllers, databases, servers, virtualisation systems, document workflows, workstations, VPNs, and administrative consoles. They also listed systems including Demography and StatRegister. If accurate, that combination would affect both information and the machinery used to manage it. The article says Rosstat’s website was defaced and remained inaccessible.

The consequences extend beyond the immediate breach. Citizens may doubt official statistics, while officials may struggle to restore services or establish which records are reliable. Military analysts could gain useful information, but false or altered files could mislead them. Rosstat confirmed coordinated attacks, yet denied the claimed leak, leaving the agency’s operational damage and the data’s authenticity unresolved.

A cyberattack is an attempt to access, alter, disrupt, or damage computer systems without permission. Data exfiltration means taking information from those systems and moving it to attackers’ control. System destruction means wiping, disabling, or damaging infrastructure such as servers, databases, domain controllers, and workstations.

Attackers may first enter through stolen credentials, vulnerable software, or compromised remote access. They can then move through connected networks, copy databases and documents, and search for valuable information. Finally, they may erase systems, deface websites, or disrupt services to create confusion and make recovery harder. The hackers claimed all of these effects at Rosstat.

The article says Rosstat suffered coordinated attacks between October 29 and 31. The groups claimed to have exfiltrated 23TB while wiping major infrastructure. Rosstat acknowledged the attacks but rejected the leak claims. This shows why an incident can have separate questions: whether attackers entered, what they took, what they destroyed, and whether the released material is genuine.