- Rosstat confirmed it was targeted by a cyberattack but disputed the claimed extent of the breach.
- Rosstat said it found no evidence that protected information had been leaked or its databases compromised.
- The Record said Cyber Partisans and Silent Crow claimed to have taken out Rosstat in a cyberattack over the weekend.
Rosstat said its security systems detected suspicious activity in time for specialists to respond. It disputed the claimed extent of the breach and said it found no evidence that protected information had been leaked or its databases compromised.
The Record said claims about the scale of the breach and infrastructure destruction could not be independently verified.
On this page
The groups claimed access to Rosstat’s critical systems and data
The Record said the Cyber Partisans claimed they first gained access to the network about six months earlier and spent four months moving through its systems.
The Record said the hackers claimed they compromised domain controllers, virtualization platforms and infrastructure-management tools. It also said they claimed access to databases containing economic, demographic and personal information, census records and internal government correspondence.
Silent Crow claimed the operation gave the hackers access to approximately 25,000 computers and other devices across Rosstat facilities.
The claimed destructive phase followed a month of preparation
The Record said the hackers claimed they began preparing for the destructive phase about a month before the operation, with the most intensive activity during the previous two weeks. It said they claimed the attack culminated overnight on Saturday with destruction of physical and virtual servers and large-scale data storage systems.
The Record said the groups claimed they replaced content on Rosstat’s servers with official Ukrainian statistics on Russian military losses, which they said remained publicly accessible for about an hour. It also said Kommersant reported that Rosstat’s main website and regional portals were defaced with messages including “No one will escape accountability.”
The Record said the claims about the breach’s scale, infrastructure destruction and sensitive-data access could not be independently verified.
The groups previously claimed an Aeroflot operation
The Record said Cyber Partisans and Silent Crow claimed responsibility in July 2025 for a disruptive cyberattack on Aeroflot that forced more than 100 flight cancellations and affected roughly 20,000 passengers.
Rosstat said it was working with cybersecurity experts and law enforcement to identify the source of the attacks.
FAQ
Was Rosstat’s data compromised?
Rosstat said it found no evidence that protected information had been leaked or its databases compromised.
Who claimed the Rosstat cyberattack?
The Record said Belarusian Cyber Partisans and Silent Crow claimed to have taken out Rosstat and accessed sensitive government data.
How many Rosstat devices did Silent Crow claim were accessed?
Silent Crow claimed access to approximately 25,000 computers and other devices across Rosstat facilities. The Record said claims about the scale of the breach could not be independently verified.
What did Rosstat do after the cyberattack?
Rosstat said its security systems detected suspicious activity in time for specialists to respond. It said it was working with cybersecurity experts and law enforcement to identify the source.
Sources
How we checked this story
| Claim | Source | Status |
|---|---|---|
| The Record said the Belarusian Cyber Partisans and Silent Crow claimed they had taken out Rosstat and stolen sensitive government data in a cyberattack over the weekend. | The Record | Attributed |
| Rosstat confirmed that it had been targeted by a cyberattack but disputed claims about the breach’s extent. | Rosstat, via The Record | Attributed |
| Rosstat said it found no evidence that protected information had been leaked or its databases compromised. | Rosstat, via The Record | Attributed |
| Rosstat said its security systems detected suspicious activity in time for specialists to respond. | Rosstat, via The Record | Attributed |
| Rosstat said it was working with cybersecurity experts and law enforcement to identify the attack’s source. | Rosstat, via The Record | Attributed |
| The Record said the Cyber Partisans said they first gained access to Rosstat’s network about six months earlier and spent four months moving through its systems. | The Record | Attributed |
| The Record said the hackers said they began preparing for the destructive operation about a month before the attack, with the most intensive activity during the previous two weeks. | The Record | Attributed |
| The Record said the hackers said the attack culminated overnight on Saturday with destruction of physical and virtual servers and large-scale data storage systems. | The Record | Attributed |
| Silent Crow claimed the operation gave the hackers access to approximately 25,000 computers and other devices across Rosstat facilities. | Silent Crow, via The Record | Attributed |
| The Record said the hackers claimed they compromised network-management systems including domain controllers, virtualization platforms and infrastructure-management tools. | The Record | Attributed |
| The hackers claimed they breached databases containing economic, demographic and personal information, census records and internal government correspondence. | The Record | Attributed |
| The Record said the hackers’ claims about the breach’s scale, infrastructure destruction and sensitive-data theft could not be independently verified. | The Record | Attributed |
| The Cyber Partisans said they planned to publish a detailed account and samples of allegedly stolen data in the coming days. | The Cyber Partisans, via The Record | Attributed |
| The Record said the groups claimed they replaced Rosstat server content with Ukrainian statistics on Russian military losses, which remained publicly accessible for about an hour. | The Record | Attributed |
| The Record said kommersant reported that hackers defaced Rosstat’s main website and regional portals with messages including a Belarusian accountability warning. | The Record | Attributed |
| telegra.ph published its report on Nov 1, 2026. | telegra.ph | Confirmed |
Could not verify
- Whether protected information was leaked or Rosstat databases were compromised is not established.
- Whether the hackers accessed approximately 25,000 devices is not independently established.
- Whether the claimed destruction of Rosstat infrastructure occurred is not independently established.
- How many people were affected by the incident is not established.
Related stories
AI Supply ChainGoogle disrupted XCPE botnet and banned Videostrong after 1.3M infections
Vulns & PatchesSupermarket refrigeration systems across Europe disrupted by cyberattacks
AI Supply ChainLiteLLM 1.107.0 malicious release could expose credentials and AI tokens