Belarusian hackers claim breach of Russia's Rosstat and copying of data on Russian war losses

In brief

• Belarusian Cyber Partisans and Silent Crow say they breached Rosstat's internal IT systems and copied about 23 terabytes of data.
• The hackers claim the material includes information on Russian military losses in the war against Ukraine.
• Rosstat confirms a coordinated cyberattack between Oct. 29 and Nov. 1 but denies that databases or legally protected information were leaked.

Hackers' claims

Silent Crow, which works alongside Cyber Partisans, says it got into Rosstat's internal IT systems, covering headquarters, regional offices and the Main Interregional Center for Processing and Distribution of Statistical Information (Hackers breach Russia's statistics agency, obtain data on Russian losses in Ukraine – Ukrinform) (Белорусские хакеры взломали сайт Росстата. Они утверждают, что получили доступ к информации о потерях России в войне – Meduza). The groups say they took control of around 25,000 computers ("Кіберпартизани" й Silent Crow заявили, що вкрали в Росстату 23 ТБ даних, зокрема про втрати РФ у війні – Espreso) and copied about 23 terabytes of data. According to the claims, the files include databases, internal documents, service correspondence and material from employees' work computers («Киберпартизаны» и Silent Crow взломали российский Росстат – Charter 97).

The hackers also state that the stolen material contains information on Russian military losses in the war against Ukraine (Russia’s Statistics Agency Hit by Cyberattack as Hackers Claim Massive Data Theft – The Moscow Times) («Киберпартизаны» и Silent Crow взломали российский Росстат – Zerkalo).

Messages on the website and Rosstat's response

Belarusian-language notices appeared on Rosstat's main website and on its regional portals. One warned that no one would escape accountability.

Rosstat told RBC that its websites were hit by a coordinated attack carried out between Oct. 29 and Nov. 1. The agency described the operation as carefully planned, aimed at several areas at once and carried out from many locations. According to the agency, its monitoring tools flagged unusual activity early enough for employees to react. Rosstat rejected claims that databases or information protected by law had been compromised (Росстат прокомментировал атаку «Киберпартизан» и Silent Crow – Zerkalo).

The main website was reported unavailable at the time of Rosstat's statement. Meduza reported that the site was working again on the morning of Nov. 1.

Background

The claims have not been independently verified. Russia classifies both groups as extremist, and their activity is prohibited there.