Rosstat confirms destructive attack; hackers claim 23TB theft
Rosstat, Russia's federal statistics service, confirmed destructive cyberattacks, with its main website and regional portals defaced in Belarusian and offline. The groups Cyber Partisans and Silent Crow claim access to about 25,000 machines, theft of 23TB including data on Russian military losses in Ukraine, and destruction of servers; Rosstat denies that its databases were compromised. No fix applies, and the groups say they will publish samples of the allegedly stolen material.
What happened
Belarusian and pro-Ukrainian hacking groups say they breached and destroyed systems at Rosstat, Russia's federal statistics service. Rosstat confirms destructive attacks, with defaced websites and its main portal offline, but denies any data theft. The attackers claim to have stolen 23TB, including data on Russian military losses in Ukraine.
Why it matters
Rosstat holds demographic, economic and personal data, census records and statistics from occupied Ukrainian territories, giving the allegedly stolen material high value. The destruction of servers took down publication of official statistics. The case shows the risk of a long, silent intrusion ending in a destructive attack with operational impact.
What to do
Use the case as a benchmark: review detection of prolonged internal movement, segmentation of domain controllers, and server recovery plans. Organizations holding sensitive third-party data should assess the political risk of becoming targets. No fix applies.
For the technical team
- Affected
- Rosstat, serviço federal de estatísticas da Rússia; grupos Cyber Partisans e Silent Crow alegam domínio de cerca de 25 m · Rosstat: headquarters, regional offices and main statistical data processing center; about 25,000 computers and devices, according to the groups.
- Exploitation
- Destructive attack confirmed by the victim, which says its security systems detected suspicious activity in time to respond; the 23TB theft and control of 25,000 machines remain claims by the groups Cyber Partisans and Silent Crow, who say they will release a detailed account and data samples in the coming days.
- Fix
- No fix applies; Rosstat is working with cybersecurity experts and law enforcement to identify the source of the attacks.
- Vector
- According to the attackers, initial access about six months ago, four months of silent movement and document collection, and a destructive phase prepared over the past month, with intensive activity in the last two weeks. Claimed compromise of domain controllers, virtualization platforms and infrastructure management tools, culminating in wiping physical and virtual servers and large-scale storage systems.
- More details
- Attackers say they replaced server content with official Ukrainian statistics on Russian military losses, publicly accessible for about an hour; Kommersant reported defacement of the main website and regional portals with a warning in Belarusian. The groups claim access to confidential mortality records with causes of death, nonpublic statistics from occupied territories, census data and internal correspondence. It is the same alliance behind the July 2025 Aeroflot attack, which cancelled more than 100 flights and affected roughly 20,000 passengers; Cyber Partisans say Rosstat had more robust security than the airline. Russia's Supreme Court designated both groups as extremist organizations in July.
Timeline
Rosstat confirms the cyberattack claimed by the alliance of Belarusian and pro-Ukrainian hacker groups.
New post reiterates the 23 TB theft claim and details that the material would include data on Russian military losses in Ukraine.
Russia confirms the attack but says no data was stolen; the claimed trove would include details of Russian losses in the Ukraine invasion.
Want the next updates in your inbox? Get the daily edition →
See all 4 updates
Groups claim the attack and the victim confirms destructive intrusion with defaced sites.
Sources 4 sources
- @IntCyberDigest @IntCyberDigest
- @hoje_no @hoje_no
- @NewsLiberdade @NewsLiberdade
- Russia's statistics agency confirms cyberattack claimed by Belarusian and Ukrainian hackers The Record
