A major Rosstat cyberattack carried out over the weekend by pro-Ukrainian and Belarusian hackers has disrupted Russia’s federal statistics agency and compromised internal government infrastructure, according to statements released on 1 November 2026. The hackers claimed to have wiped servers and extracted demographic records, while the state agency confirmed an intrusion took place.
Key points
- Pro-Ukrainian hacking group Silent Crow and the Belarusian Cyber Partisans claimed responsibility for infiltrating Russia’s federal statistics agency.
- The intruders claimed to have accessed roughly 25,000 internal devices, destroying physical servers, virtual machines and network management platforms.
- Stolen material allegedly includes mortality records, nonpublic data from occupied Ukrainian territories and internal state correspondence.
- Rosstat confirmed it suffered a cyberattack but claimed specialists contained the incident without any data leakage.
Details of the network intrusion
The cyber operation against Russia’s Federal State Statistics Service, commonly known as Rosstat, culminated during the overnight hours of 31 October 2026. According to statements published by the attackers, the disruption ended a six-month espionage operation conducted inside the agency’s primary networks.
The hackers spent their first four months inside the network mapping out connected systems, collecting internal files and expanding administrative access. They moved through directories without detection before beginning preparations for the destructive phase roughly four weeks ago, intensifying their actions over the final fortnight of October.
Silent Crow said the infiltration gave operators access to approximately 25,000 computers and connected network units. That inventory spanned Rosstat headquarters in Moscow, multiple regional outposts and the agency’s central statistical processing facilities.
During the final phase of the operation, the attackers wiped physical and virtual servers. They targeted virtualization platforms, core domain controllers and storage area networks, aiming to cripple the agency’s operational capacity across the country.
The scale of the destruction recalls previous coordinated intrusions against public sector registries, similar to how a recent breach of federal personnel records crippled administrative workflows across multiple agency divisions.
Stolen databases and demographic records
Beyond wiping administrative servers, the hackers claimed to have extracted vast quantities of confidential government data. Rosstat serves as the central clearing house for Russian economic, demographic and civic statistics, making its internal datastores high-value intelligence targets.
Among the records allegedly extracted were detailed mortality databases that include unpublished causes of death across Russian regions. In wartime conditions, such figures provide external analysts with vital clues regarding combat casualties and regional demographic shifts.
The groups also asserted that they captured nonpublic records gathered from Ukrainian territories currently under Russian occupation. These files contain administrative surveys, local population figures and regional economic activity collected by occupying authorities.
Other compromised databases reportedly held census entries, economic monitoring data and internal communications between Rosstat directors and other federal ministries. The attackers claimed the material contains frank internal assessments that contradict public economic projections released by the government in Moscow.
Independent analysts have not yet verified the authenticity or scope of the exfiltrated archives. The Cyber Partisans stated that they intend to publish downloadable samples of the stolen databases alongside a full technical post-mortem in the coming days.
Defaced portals and the state response
Before wiping infrastructure, the hackers defaced the public web presence of the agency. Visitors to the primary statistical portal and several regional subdomains were redirected to pages showing Ukrainian figures for Russian military personnel losses.
An archived defaced portal showed that the attackers replaced official economic indicators with casualty tallies, leaving the altered text live for approximately one hour before the agency took its web services offline.
The defaced pages also featured messages written in Belarusian warning state employees that perpetrators of state actions would face accountability. The defacements disrupted online data reporting for businesses and public users attempting to submit mandatory monthly reports.
Rosstat acknowledged the intrusion in comments provided to state news agency TASS. The agency said security software detected abnormal traffic patterns, enabling defensive teams to isolate affected segments before databases could be extracted or altered.
The agency maintained that its primary data repositories suffered no permanent compromise and that personal information held on Russian citizens remained secure. Rosstat confirmed it was working with national cybersecurity specialists and law enforcement agencies to track the origin of the assault.
The alliance behind the attack
The assault marks another joint operation between the Belarusian Cyber Partisans and Silent Crow, two dissident hacking collectives that have repeatedly hit high-profile Russian targets. The groups have increasingly combined resources to execute complex network compromises.
In July 2025, the two collectives teamed up to strike Russia’s flagship carrier Aeroflot. That incident forced the airline to ground more than 100 passenger flights, disrupted travel for roughly 20,000 passengers and resulted in the publication of travel records belonging to the airline’s chief executive.
The Cyber Partisans stated that penetrating Rosstat required substantially more effort than the airline intrusion. The group said the statistical service maintained stricter boundary defences and segmented access controls, forcing operators to proceed methodically over several months to avoid alerting network defenders.
Silent Crow dismissed the government’s claims that the damage had been contained. “It looks like Rosstat will have to recalculate not only its statistics this time, but also the scale of its own problems,” Silent Crow said in a public statement.
The Cyber Partisans formed in late 2020 amid civilian protests against the disputed re-election of Belarusian President Alexander Lukashenko. The group initially targeted Belarusian state police registries and railway networks before widening its scope to Russian federal institutions following the 2022 invasion of Ukraine.
Silent Crow has similarly claimed a string of intrusions into Russian state infrastructure, including a previous operation against Rosreestr, the Russian federal service for state registration, cadastre and cartography. In October, the Cyber Partisans revealed that they had spent months inside Moscow’s municipal healthcare system after obtaining administrative credentials in 2023.
Structural vulnerabilities in federal networks
The incident highlights ongoing difficulties Russian institutions face in securing federal information systems. Research published on restrictive state network controls shows how attempts to construct an isolated domestic internet have created operational bottlenecks for public agencies, often complicating regular software patching and threat monitoring.
Federal institutions have also struggled with broader software perimeter vulnerabilities. Analysis of vulnerability trends across public networks shows that advanced intrusion groups frequently exploit unpatched virtualisation platforms and remote management tools to gain initial network footholds.
In July 2025, the Russian Supreme Court designated both the Cyber Partisans and Silent Crow as extremist organisations. The ruling made participation in or communication with the groups a criminal offence under Russian domestic law.
The legal designation appears to have had little deterrent effect on the hackers, who operate from outside Russian jurisdiction. Both collectives continue to solicit leaked credentials and technical intelligence from sympathetic insiders working inside Russian public bodies.
The Cyber Partisans have scheduled the publication of their first technical dossier on the Rosstat breach for later this week.
