Hacker groups claim 23TB Rosstat breach exposes Russia's hidden war losses

Belarusian Cyber Partisans and Silent Crow claim they breached Russia’s Federal State Statistics Service, Rosstat, and stole about 23 terabytes of data. The groups say the leak includes records marked "for official use only" and suggests that as many as 50,000 Russian soldiers are killed in Ukraine each month. Rosstat confirmed targeted cyberattacks but said its databases were not compromised.

What the hackers claim

After claiming responsibility for the attack, the groups said they gained access to around 25,000 Rosstat computers and servers. They allegedly stole roughly 23 terabytes of data and destroyed part of the agency’s internal IT infrastructure. The new haul includes data on Russian wartime losses marked "for official use only." The groups also said their logos appeared on Rosstat’s federal website and on regional office sites on November 1, while the main Rosstat website was still "temporarily unavailable" at the time of writing.

War loss figures and missing statistics

Since 2024, Rosstat has not published annual cause-of-death statistics. The hackers are now sharing a chart suggesting that as many as 50,000 Russian soldiers are killed in Ukraine every month. The General Staff of the Armed Forces of Ukraine said Russia has lost 1,594,830 troops in Ukraine since the beginning of its full-scale invasion in February 2022. Rosstat processes mortality data, including deaths resulting from military operations, and the listed causes of death include injuries resulting from military operations.

What Rosstat and the hackers said

Silent Crow, described as a pro-Ukraine hacktivist group usually targeting Russia and its allies, said it gained access to the infrastructure of Rosstat’s central office, its regional branches, and its Main Interregional Center for the Processing and Dissemination of Statistical Information. The group said it obtained access to domain controllers and virtualization servers running VMware ESXi, oVirt, and zVirt. Belarusian Cyber Partisans added that systems destroyed included STATEK, CSOD, Demography, SED, ESSO, OFSN, internal employee surveillance, StatRegister, websites and more. Rosstat confirmed the cyberattack to Kommersant, but said its databases had not been compromised. The agency said its information resources were subjected to targeted destructive cyberattacks from October 29 through November 1, and that monitoring systems detected suspicious activity so specialists could respond quickly.

Broader context

Moscow stopped publishing statistics on causes of death in 2024. Next year, according to The Insider, many Rosstat figures on births, deaths, marriages, divorces, social benefits, and recipients of state assistance will also disappear from public access. The Insider said all this data could be used to indirectly assess the consequences of the war in Ukraine, including the number of combat veterans and funeral payments. Belarusian Cyber Partisans and Silent Crow are both designated as extremist in Russia. In 2025, they claimed responsibility for a major hack of Russia’s national airline Aeroflot, and experts later said the company’s entire infrastructure was on the verge of collapse.

Sources: Cybernews