Cyberattack Hits Rosstat as Hackers Claim Huge Data Theft

Rosstat reported that hackers attacked its main website and regional portals between October 29 and November 1. The operation was coordinated and carefully planned. Messages from the Belarusian Cyber Partisans and Silent Crow appeared on the sites, including a Belarusian warning that no one would escape accountability. The incident matters because Rosstat provides official statistics, and public access to those figures was disrupted.

Rosstat said the attackers worked simultaneously across several areas. Specialists with different expertise operated from many locations. The agency’s monitoring systems detected suspicious activity, allowing staff to respond quickly. Rosstat said it had found no evidence that databases or legally protected information had been leaked. Its main website was still inaccessible when the article was published.

The hackers claimed they stole 23 terabytes of files. They said the material included wartime-loss figures, demographic and economic statistics, and documents marked for official use only. Those claims were not independently verified. The episode leaves two separate questions: how widely services were disrupted, and whether confidential information was actually taken.

A cyberattack is an attempt to interfere with, access, damage, or control computer systems without permission. It can target a public website, the network behind it, or an organization’s internal services. The immediate result might be an outage, altered webpages, stolen passwords, or slower access. A disrupted website therefore shows that systems were attacked, but it does not by itself prove that databases were stolen.

For example, attackers may overwhelm a website with requests, exploit a software weakness, or gain access to an administrator account and post messages. These actions can interrupt service or change visible content. Separately, stealing a database usually requires accessing, copying, and transferring stored files. Security logs, access records, and forensic analysis help distinguish these events.

In this case, messages appeared on Rosstat’s websites, and the main site was inaccessible at publication. Rosstat said monitoring systems detected suspicious activity and denied leaks of databases or legally protected information. The hackers claimed otherwise, but their claims could not be independently verified.

The article identifies the Belarusian Cyber Partisans and Silent Crow as hacking groups. It does not provide biographies, membership details, or a formal account of how they operate. Russia designates both groups as extremist and bans them. Their messages appeared on Rosstat’s main website and regional portals during the reported attack.

The groups claimed that they stole 23 terabytes from Rosstat. They said the files included Russian wartime-loss information, demographic and economic statistics, and documents marked for official use only. They also claimed responsibility for a July 2025 attack on Aeroflot’s IT systems, which caused widespread disruption. Russian prosecutors confirmed that an attack occurred and opened a criminal investigation.

Silent Crow separately claimed in January 2025 that it had stolen two billion property-owner records from Rosreestr. Rosreestr denied a leak, but journalists verified some published information. These earlier claims provide context, not automatic proof that the Rosstat allegations are true. The article says the latest claims remain independently unverified.

The claimed scale was 23 terabytes of data. That is a very large volume of digital material, but the figure remains an allegation rather than a confirmed measurement. The article says the hackers claimed the files came from Rosstat and included several sensitive or politically important categories.

According to the hackers, the material contained data on Russian wartime losses, demographic statistics, and economic statistics. They also said it included documents marked “for official use only.” Rosstat’s official methodology includes a category for deaths resulting from military operations, although the agency stopped publishing annual cause-of-death statistics in 2024. Other potentially useful war-impact data have also disappeared from public access.

The distinction between a claim and verified evidence is central. Rosstat said its monitoring systems detected suspicious activity quickly and denied that databases or legally protected information had leaked. The article offers no independent confirmation of the 23-terabyte figure or the alleged contents. Readers should therefore treat the amount and categories as reported claims, not established facts.

Investigators can test a breach claim by comparing released files with authentic records, checking whether names and fields follow real database patterns, and examining timestamps or file metadata. They can also inspect network logs, access records, malware traces, and unusual transfers on the affected organization’s systems. Independent experts may compare samples with information previously available from public sources.

The article gives one concrete precedent. Silent Crow claimed in January 2025 to have stolen two billion Rosreestr property-owner records. Rosreestr denied a leak, but journalists verified some information that the hackers published. That kind of direct checking can show that at least some data are genuine, though it may not establish the size or source of the entire alleged breach.

For the Rosstat incident, the hackers claimed 23 terabytes of files and listed several categories. Rosstat denied database or protected-information leaks. The article says the hackers’ claims could not be independently verified. Therefore, visible website disruption is evidence of an attack, not proof of the alleged data theft.

Wartime-loss, demographic, and economic statistics help people understand what is happening and evaluate government claims. If such data are stolen, altered, hidden, or made unavailable, the public may struggle to measure deaths, population changes, or economic damage. Researchers and journalists may also lose evidence needed to compare conditions over time.

The article highlights this concern through Rosstat’s publication practices. Its methodology includes a category for deaths resulting from military operations, but the agency stopped publishing annual cause-of-death statistics in 2024. Other data that could help assess the war’s impact have also disappeared from public access. A cyberattack could add another barrier by disrupting access or raising doubts about data integrity.

The immediate facts remain uncertain. Rosstat denied that protected databases leaked, while hackers claimed wartime-loss and other statistics were stolen. Their claims were not independently verified. Regardless of the breach’s final scope, unavailable or disputed statistics make accountability more difficult and increase the importance of preserving trustworthy records.

A national statistics agency collects, processes, and publishes data about a country’s population, deaths, economy, and other conditions. Rosstat’s methodology includes a category for deaths resulting from military operations. Such agencies turn many individual records and measurements into standardized figures that can be compared across regions and years.

Societies depend on accurate statistics because governments, researchers, journalists, and the public use them to assess needs and outcomes. In this case, hackers claimed Rosstat files included wartime losses, demographic and economic statistics, and documents marked for official use only. The agency denied that databases or legally protected information had leaked, but its main website was inaccessible when the article appeared.

The article also notes that Rosstat stopped publishing annual cause-of-death statistics in 2024, while other war-impact data disappeared from public access. That makes reliable access especially important. The reported attack could deepen uncertainty, even though the data-theft claims remain unverified. Protecting both systems and publication practices supports public trust.