The defacement appeared on the pages of Rosstat's regional offices as well as in the federal section of the site, according to Kommersant, which first spotted it. RBC and Novaya Gazeta Europe also reported the breach. The site was back online by morning.
Silent Crow said it acted together with Cyberpartisans BY. The group claimed the hackers gained access to "a significant part" of the agency's IT infrastructure, including its central office, regional divisions and the Main Interregional Center for Processing and Disseminating Statistical Information.
Silent Crow said the data obtained included "information relating to Russia's military losses in the war against Ukraine, including data held in Rosstat systems." The group said about 23 TB of information was downloaded in total, most of it databases, internal documents, official records and data from employees' work computers. The hackers also claimed to have destroyed Rosstat's internal IT infrastructure.
Rosstat confirmed the cyberattack. Its press service said the attacks "were thoroughly prepared in nature and carried out in various directions" and had continued since October 29. The agency said it had "not recorded any leak of databases or legally protected information as a result of the attack."
Cyberpartisans BY and Silent Crow previously claimed responsibility for an attack on Aeroflot's IT systems in July 2025. The outage affected tens of thousands of passengers, and Aeroflot lost at least 260 million rubles from flight cancellations alone, according to Meduza. In July 2026, Russia's Supreme Court designated both groups as "extremist organizations."
The accounts diverge: the hackers say they obtained data on Russia's military losses and downloaded 23 TB of information, while Rosstat says it recorded no leaks of databases or legally protected information.