Rosstat, Russia's federal state statistics service, has confirmed that its websites were hit by what it called a coordinated, well-prepared cyberattack between October 29 and November 1, 2026. Two hacking groups, the Belarusian Cyber Partisans (Cyberpartisans BY) and Silent Crow, have claimed responsibility. They say they took control of about 25,000 machines, stole roughly 23 TB of data, including material on Russia's military losses in the war against Ukraine, and destroyed parts of the agency's internal IT systems. Rosstat confirms the attack but denies that any databases or legally protected information leaked. Nobody has independently verified the hackers' claims, and the reported figures differ: a Cyber Partisans post cited by Ukrainian outlet UNN puts the stolen volume at "more than 10 TB", not 23 TB.
What Happened
Overnight into Sunday, November 1, visitors to Rosstat's federal website and its regional office pages found a defacement message in Belarusian: "No one will escape accountability." It was shown alongside the logos of Cyberpartisans BY and Silent Crow. Kommersant spotted the defacement first, according to Meduza, DW and FACTUM. RBC and Novaya Gazeta Europe also reported it.
Rosstat's press service told RBC and Kommersant that the attacks "were thoroughly prepared in nature and carried out in various directions." It said they ran from October 29 to November 1 and involved specialists with different skills working from many locations. The agency said "the infrastructure worked as intended" and that its monitoring systems flagged the suspicious activity in time for staff to respond.
Reports disagree on how long the site was down. Meduza, Reflect.ee and FACTUM said the site was working again by the morning of November 1. The Moscow Times reported later that day that the main site was still unreachable. DW quoted Rosstat as promising to restore the site "in the near future."
Silent Crow announced the operation on Telegram, according to Axar.az, and said it was carried out jointly with the Cyber Partisans. UNN quotes a separate Cyber Partisans post saying the groups destroyed the "heart" of Rosstat. UNN also reports, citing that post, that the hackers published official Ukrainian figures on Russian war losses on the Rosstat website. No other outlet reporting on the defacement has confirmed this.
Both groups have attacked Russian targets before. They claimed the July 2025 attack on Aeroflot's IT systems. According to Meduza, that attack disrupted travel for tens of thousands of passengers and cost the airline at least 260 million rubles in flight cancellations alone. Russian prosecutors confirmed that attack and opened a criminal case. In January 2025, Silent Crow claimed to have stolen a database of 2 billion property-owner records from the state real estate registry Rosreestr, which the agency denied, according to The Moscow Times. Russia's Supreme Court designated both groups "extremist organizations" in July 2026.
What Was Taken
All of the following comes from the attackers and has not been verified. Rosstat denies that any data leaked.
- Volume: Silent Crow says about 23 TB was taken during its time inside the network, according to Meduza, DW, FACTUM, Reflect.ee and Axar.az. The Cyber Partisans post quoted by UNN says "more than 10 TB" of documents and databases. Neither figure has been confirmed.
- Scale of access: Silent Crow claims control of about 25,000 machines across Rosstat's central office, its regional branches and the Main Interregional Center for Processing and Disseminating Statistical Information, according to DW, Business FM and Axar.az.
- Data types: The groups list databases holding statistical, economic and personal information, population census materials, the electronic document management system, internal and official documents, and files from employees' work computers.
- Sensitive material: Axar.az reports that the group claims about 2 TB of restricted-access documents, including information about Russian military losses. The Moscow Times says the claimed haul includes documents marked "for official use only." UNN quotes the Cyber Partisans as also claiming information classified as a state secret.
- Destruction: UNN quotes the Cyber Partisans as saying they destroyed systems named STATEK, TsSOD, "Demography," SED, ESSO, OFSN, "Statregister," TsAP and an employee monitoring system. The same post lists databases, servers, the virtualization environment, workstations and VPNs among the affected infrastructure.
The war-loss claim matters for a specific reason. The Moscow Times notes that Rosstat's methodology includes a category for deaths caused by military operations, but the agency stopped publishing its annual cause-of-death statistics in 2024. Other data that could show the war's demographic impact has also been removed from public access.
Why It Matters
The claims and the denial are far apart. If the attackers are right, this would be one of the largest compromises of a Russian government body on record: domain-wide control, deep access to virtualization, and data destruction. If Rosstat is right, the incident was a website defacement that was caught and contained. Alexei Gorelkin, CEO of security firm Phishman, told Business FM that the claims sound "very ambitious." He said moving 23 TB out in a short window, including over a weekend, should have produced traffic changes the security team would notice, and he called the announcement more of a PR move. He added that if the infrastructure really was destroyed, the attackers must have had near-total access, which would make data theft plausible as well. The Aeroflot case is relevant here: the same groups' claims were followed by real, confirmed operational damage.
Hacktivists are destroying systems, not only defacing them. Both groups now follow a consistent pattern: get in deep, steal data, wipe the virtualization and management layers, then announce it with a defacement. Defenders should treat a defacement by an actor with this track record as a possible sign of deeper compromise, not as a cosmetic problem.
The stolen data is politically valuable. Statistical agencies hold census, demographic and economic data that governments may choose not to publish. That makes them targets for exposure as well as espionage. If the war-loss data is real, its main value is in being made public, so a staged leak would be the expected next step.
Domestic virtualization platforms are in scope. Axar.az reports that the attackers named zVirt, a Russian-developed virtualization platform, alongside oVirt and VMware ESXi. Hypervisor-level destruction is now standard practice for these attackers.
The Attack Technique
Neither Rosstat nor the attackers have disclosed how the first access was gained. Based on the attackers' statements:
- Infrastructure compromised: Domain controllers and virtualization management systems (zVirt, oVirt, VMware ESXi), according to Axar.az. Control of these would give an attacker administrator access across the whole environment and the ability to wipe virtual machines in bulk.
- Lateral movement: The claimed reach across central, regional and processing-center systems, about 25,000 endpoints in total, points to compromise of Active Directory across the domain, not a foothold confined to one segment.
- Remote access: The Cyber Partisans list VPNs among the affected systems, according to UNN. That fits with VPN access being either the way in or something the attackers took over and later destroyed.
- Destruction phase: Wiping servers, workstations, the virtualization layer and core business applications, followed by a public defacement as the announcement.
- Dwell time: Rosstat's own account dates the activity to at least October 29. Silent Crow speaks of "our time in the infrastructure," which suggests the attackers were inside for longer than the final few days.
Gorelkin told Business FM that taking over a public website does not by itself mean internal access, because sites are often hosted on separate external infrastructure. Whether the defacement and the claimed internal compromise are the same intrusion has not been shown publicly.
What Organizations Should Do
- Treat defacements as possible signs of deeper compromise. When a group known for destructive attacks claims a defacement, start a full investigation of Active Directory, the hypervisors and remote access, not just a web server rebuild.
- Separate and harden hypervisor management. Put the ESXi, oVirt and zVirt management interfaces on a dedicated admin network. Require MFA and separate admin accounts that are not joined to the main domain. Turn on lockdown modes where they exist.
- Protect domain controllers and privileged accounts. Use tiered administration and monitor for DCSync, new domain admins and changes to Group Policy. Reset the KRBTGT password twice after any suspected compromise.
- Watch for large outbound data transfers. Set baselines for outbound volume and alert on sustained large transfers, especially outside working hours and at weekends, which is exactly the kind of signal Gorelkin said should have been visible.
- Keep offline, immutable backups. Store backups of virtual machines, databases and document management systems out of reach of domain and hypervisor credentials, and test that you can restore from them. Attacks that aim to destroy systems target backups first.
- Lock down VPN and remote access. Enforce phishing-resistant MFA, patch VPN appliances quickly, review VPN session logs for unusual locations or simultaneous logins, and remove unused accounts.
Sources: Russia's Statistics Agency Hit by Cyberattack as Hackers ... | Белорусские хакеры взломали сайт Росстата | Росстат подтвердил кибератаки, но опроверг утечку данных | Hackers deface Rosstat website and claim access to Russian war casu... | Belarusian hackers breached the website of Russia's statistics agen... | Белорусские хакеры взломали сайт Росстата. Они утверждают, что полу... | Rosstat suffered a large-scale cyberattack: databases and ... | Hackers claim massive breach of Russia's Rosstat Axar.Az