Visitors to Russia’s Federal State Statistics Service website encountered messages left by hackers overnight on November 1, 2026, instead of the agency’s usual statistics. The messages appeared on both the federal portal and regional offices’ websites. Belarusian Cyber Partisans and the group Silent Crow claimed responsibility. Within days, the story had moved beyond a website defacement: journalists had obtained extensive mortality records reportedly extracted from the agency’s internal systems.
What has been confirmed
Rosstat acknowledged that its information systems had been targeted between October 29 and November 1. The agency said the attacks came from several directions and that its information-security specialists were working with law enforcement. On November 1, Kommersant reported that the content of the federal and regional websites had been altered. The pages displayed the two groups’ insignia and a message in Belarusian: “No one will escape responsibility.”
Rosstat also maintained that its monitoring systems had detected suspicious activity in time, that its databases had not been compromised and that no leak of legally protected information had been identified. That remains the agency’s official position. It does not, however, resolve questions about the origin of the documents subsequently provided to journalists.
What the attackers claim
Cyber Partisans and Silent Crow say they gained access to Rosstat’s internal infrastructure, including its central headquarters, regional branches, document-management systems and statistical databases. They claim to have compromised approximately 25,000 computers and servers and copied roughly 23 terabytes of information. The categories they describe include economic and demographic statistics, internal correspondence, census documents and records of causes of death.
Those figures come from the attackers themselves. No publicly available independent forensic assessment has established that they accessed every device claimed or copied the stated volume of data. Defacing a public website is not, by itself, proof of access to internal databases: the two represent different levels of system compromise.
Why this is more than a website defacement
By the second week of November, international newsrooms were examining a collection of death records linked to the reported breach. The Guardian and Le Monde were among the outlets to publish reporting based on the material. The records have significance beyond the attack itself: Russian authorities have restricted the publication of detailed cause-of-death statistics, including information that could help assess the human consequences of the war against Ukraine.
The appearance of a substantial dataset in journalists’ hands challenges the early impression that the incident was confined to a changed homepage. Yet possession of files does not establish precisely how they were obtained, whether every document is authentic or whether the material seen by journalists represents anything close to the 23 terabytes claimed by the attackers.
Preliminary death tolls circulated by the groups vary depending on which categories are counted. They should not be treated as a single definitive figure for Russian military fatalities. The methodology, composition of the records and regional patterns warrant a separate investigation.
Were government records destroyed?
In an interview published by Deutsche Welle on November 10, Cyber Partisans representative Dmitry Shchigelsky said the operation was intended not only to obtain information but also to damage systems used in government economic management. He claimed that some original datasets had been destroyed beyond recovery.
There is no independent public confirmation that the records were irretrievably lost. The completeness of backups, the extent of any damage and the specific Rosstat functions affected remain unknown. It would therefore be premature to conclude that the Russian state has lost its ability to manage the economy. Nevertheless, the potential destruction of underlying statistical records would be far more consequential than a temporary outage of a public website: such records feed official indicators, reporting and assessments of demographic and economic trends.
A previous attack and questions about security
Both groups previously claimed involvement in a July 2025 attack on Aeroflot, which was followed by major disruptions to the airline’s operations. That history helps explain the attention given to their latest claims, but it does not independently establish the scale of the Rosstat intrusion.
The independent outlet Important Stories examined Rosstat’s procurement records and reported that the agency had spent at least 231 million rubles on cybersecurity over three years. The spending figure alone cannot show whether the money was used effectively or identify the vulnerabilities exploited. Such conclusions would require technical reports that have not been made public.
What remains unknown
As of November 10, the established facts include a cyberattack acknowledged by Rosstat, alterations to official websites, the attackers’ claims of extensive internal access and the emergence of purported internal statistical records in newsrooms. What remains unverified is the total amount of information taken, the complete list of affected systems and whether any destroyed datasets truly cannot be restored.
The central public-interest issue now extends beyond cybersecurity. If government statistics withheld from the public become available only through unauthorized access to official systems, that raises questions about state transparency and the public’s ability to understand the consequences of the war. Answering those questions requires a clear distinction between authenticated records and claims made by the attackers.