Russian Federal State Statistics Service says it was hit by massive cyberattack — hackers steal 23TB of data, including Ukraine war casualty figures

Rosstat, Russia’s state statistics agency, was targeted over the Halloween weekend from October 29 to November 1, 2026. The incident mattered because attackers claimed access across central and regional systems, not just one computer. They also published alleged military casualty figures on Rosstat’s website.

The Silent Crow group and Belarusian CyberPartisans said they stole about 23TB of data. Their claims included electronic document management records, databases, infrastructure-management systems, and information connected with military losses. They also said they accessed domain controllers and virtualization systems.

Rosstat confirmed that its information resources were attacked. It said monitoring systems detected suspicious activity and enabled a rapid response. However, the agency said it had not identified database compromise or leakage of legally protected information. The casualty figures therefore remain unverified by official Russian sources.

Data exfiltration is the unauthorized transfer or copying of information from a computer system. It is different from simply breaking into that system. An intrusion establishes access, while exfiltration shows that data was taken or moved beyond the organization’s control.

Here, Rosstat acknowledged that its information resources were targeted. Silent Crow and Belarusian CyberPartisans went further, claiming they extracted about 23TB from electronic document management systems and other databases. They also described access to central and regional infrastructure, domain controllers, virtualization systems, and management tools.

The distinction matters because access alone does not prove that sensitive files left the network. Rosstat said it had not identified database compromise or leakage of information protected by law. The alleged theft therefore comes from the hackers’ claims, while the agency’s public statement confirms the attack but disputes its reported consequences.

Twenty-three terabytes is roughly 23,000 gigabytes using decimal units. That is a very large quantity for a single reported breach, although the article does not provide a file count or independently verify the total. The scale suggests a broad claim rather than a single stolen document.

Silent Crow and its collaborators said they accessed Rosstat’s central office, regional units, and its Main Interregional Center for Processing and Dissemination of Statistical Information. They also claimed to steal the electronic document management system and other databases. Access to domain controllers allegedly led to VMware ESXi virtualization systems and infrastructure-management systems.

The reported information included casualty figures and equipment-loss figures from Russia’s war with Ukraine. The groups also claimed control of vehicles. Rosstat confirmed an attack but denied finding compromised databases or legally protected leaks, so the 23TB figure and the full list of stolen material remain allegations.

Rosstat is Russia’s state statistics agency. The article describes it as a federal department with a central office, regional units, and a Main Interregional Center for Processing and Dissemination of Statistical Information. Its role is relevant because the breach allegedly reached a broad government information network.

After the reported intrusion, Rosstat’s website displayed figures for Russian military personnel casualties and losses of unmanned aerial vehicles. The hackers said their access covered central and regional systems, internal networks, databases, and electronic document management. The article presents the figures as data exposed through the breach.

The article does not establish why Rosstat’s databases contained military casualty or equipment-loss information. It only reports that the figures appeared on Rosstat’s website after the attack. Official Russian sources were not expected to verify the numbers, leaving their accuracy uncertain.

Silent Crow and Belarusian CyberPartisans are the hacker groups identified in the article as claiming the Rosstat operation. The article calls Belarusian CyberPartisans and Silent Crow “cyberguerillas” and says the groups described their actions on Telegram. Their claims include broad access and the theft of about 23TB.

Their reported evidence includes casualty and equipment-loss figures displayed on Rosstat’s website. Silent Crow also described access to the central office, regional units, internal circuits, domain controllers, VMware ESXi systems, and infrastructure-management systems. The groups claimed they stole an electronic document management system and took control of vehicles.

Rosstat confirmed that its information resources were targeted and that monitoring systems detected suspicious activity. However, it said no database compromise or legally protected information leakage had been identified. Thus, the attack is confirmed, but the groups’ claims about the full scope and stolen data are not independently verified in the article.

Unverified casualty figures and government documents can create serious confusion when people treat them as authentic. If figures are manipulated, audiences may receive a false picture of military losses. If genuine documents are published without context, private or legally protected information could also be exposed. These are general risks of releasing disputed breach material.

The article reports that figures for Russian military personnel casualties and UAV losses appeared on Rosstat’s website. The hackers claimed to have stolen electronic document management data and other databases. Rosstat, however, said it had not identified compromised databases or leakage of information protected by law.

The immediate reality is uncertainty. The article says Russia’s official sources are unlikely to verify the casualty figures. Future reporting would need to distinguish confirmed facts from hacker claims and altered material. The breach also shows why control over government systems and published statistics matters during an active war.

A domain controller manages identities and access across an organization’s network. If attackers obtain sufficiently powerful credentials or control, they can potentially reach systems that trust those controls. The article describes this as a path from Rosstat’s wider infrastructure to central data and connected platforms.

The hackers claimed that access to Rosstat’s domain controllers unlocked the organization’s main data. They then allegedly compromised VMware ESXi virtualization systems and infrastructure-management systems. Because the reported access included central offices, regional units, and internal circuits, the claimed path extended beyond one server or user account.

The article does not describe the original entry method or independently confirm every step. Rosstat said specialized cybersecurity and law-enforcement units were investigating the attack vector and its sources. The reported sequence shows why one compromised access point can matter across a connected government environment, but the technical details remain unverified.