Russia's statistics agency says attackers got into its systems over the Halloween weekend, and two hacker groups say they left with 23TB of data and war casualty figures Moscow has kept under wraps since 2024.
Rosstat said the intrusion ran from October 29 to November 1, 2026. It said its monitoring systems flagged suspicious activity and a response began quickly. It also said that "compromising databases and leakage of information protected by law has not been identified," and that security specialists and law enforcement are working out how the attackers got in.
The Belarusian CyberPartisans and Silent Crow tell a different story. Silent Crow posted on Telegram that it reached much of the agency's IT infrastructure, including the central office, regional units and the Main Interregional Center for the Processing and Dissemination of Statistical Information. The groups also claim they took the electronic document management system and control of vehicles. Figures they published put Russian military casualties at 1,584,910 and lost drones at 587,409. Those numbers appeared on the agency's own website.
The gap between the two accounts is narrower than it looks. Rosstat has acknowledged a breach but not data theft, and its denial covers only information "protected by law" and only what has been "identified." That leaves room for a lot of stolen material.
The hackers' described route is a familiar one. They say control of domain controllers, the servers that manage logins and permissions across a network, led to VMware ESXi, the software that runs many virtual servers on one physical machine. Hold both, and nearly everything else is within reach. Rosstat has not confirmed this.
The casualty totals are the weakest part to rely on. They come from the attackers, and the source says Russian officials are unlikely to verify them. Their value is as a message: the data surfaced on a state site. The open question is how much of the 23TB is ordinary statistics and how much is something Rosstat would call protected.