Rosstat confirms cyberattack, hacker groups claim wiper and data theft

What happened

According to The Record, the Belarusian Cyber Partisans and the pro-Ukrainian group Silent Crow claim they took out Russia’s federal statistics agency, Rosstat, and stole large amounts of sensitive government data over the weekend. The groups said on Sunday that they spent months inside Rosstat’s network before a destructive operation that wiped servers. The Record

Rosstat confirmed to the state news agency TASS that it was targeted by a cyberattack. It disputes the hackers’ claims about the extent of the breach and says it found no evidence that protected information was leaked or its databases compromised. Rosstat says its security systems detected suspicious activity in time for specialists to respond, and that it is working with cybersecurity experts and law enforcement to identify the source of the attacks. The Record

What the groups claim, per The Record:

• The Cyber Partisans say they first gained access about six months ago and spent four months moving through the network and collecting internal documents. They say destructive preparation began about a month ago and the attack culminated overnight on Saturday with the destruction of physical and virtual servers and large-scale data storage.
• Silent Crow claims access to approximately 25,000 computers and other devices across Rosstat’s headquarters, regional offices and main data processing center. It also claims to have compromised domain controllers, virtualization platforms and infrastructure management tools.
• The groups claim to have taken economic, demographic and personal data, census records, internal correspondence, confidential mortality records, nonpublic statistics from Russian-occupied Ukrainian territories, and information on Russian military casualties.
• They claim to have replaced content on Rosstat servers with Ukrainian statistics on Russian military losses. The Record also cites the Russian newspaper Kommersant as reporting that Rosstat’s main website and regional portals were defaced.

The Record says the claims about the scale of the breach, the destruction of infrastructure and the theft of data could not be independently verified. The Cyber Partisans say they will release a detailed account and samples of the allegedly stolen data in the coming days. The Record

Not confirmed: the entry point, any vulnerability or malware used, the volume of data taken, whether any data was actually exfiltrated, and the extent of any server destruction.

Background from the same report: the two groups also claimed an attack on Aeroflot in July 2025. In July, Russia’s Supreme Court designated both groups as extremist organizations. The Record

Am I affected?

The sources name no CVE, software product, version or indicator of compromise, so there is nothing to check against your own systems. Not confirmed: whether any third party’s data or systems were involved. Rosstat says it found no evidence that protected information was leaked. The hackers claim that data on Russian citizens and on occupied Ukrainian territories was taken. These claims are unverified.

What to do now

1. Treat the hackers’ claims as claims. Rosstat confirms an attack but disputes the claimed extent, and no independent verification exists yet.
2. Watch for the Cyber Partisans’ promised detailed account and data samples, and for any further statement from Rosstat. Technical indicators, if published, would be the first actionable detail.
3. Editorial note, not from the sources: if your organization exchanges data with Rosstat, ask the agency directly whether you are affected rather than relying on either side’s public statements.

Sources

• The Record: Russia’s statistics agency confirms cyberattack claimed by Belarusian and Ukrainian hackers