Russia’s statistics agency confirms cyberattack claimed by Belarusian and Ukrainian hackers

An alliance of Belarusian and pro-Ukrainian hackers claimed to have taken out Russia’s federal statistics agency, Rosstat, and stolen vast amounts of sensitive government data in a cyberattack over the weekend.

The Belarusian Cyber Partisans and the pro-Ukrainian hacking group Silent Crow said Sunday they spent months inside Rosstat’s network before launching a destructive operation that wiped servers and disrupted the agency’s systems.

Rosstat confirmed that it had been targeted by a cyberattack but disputed the hackers’ claims about the extent of the breach, saying it had found no evidence that protected information had been leaked or its databases compromised.

In a statement to Russian state news agency TASS, Rosstat said its security systems had detected suspicious activity in time for specialists to respond. The agency said it was working with cybersecurity experts and law enforcement to identify the source of the attacks.

Rosstat, which collects and publishes official statistics on Russia’s population, economy and social conditions, holds extensive government data, including demographic records and information from Russian-occupied Ukrainian territories.

According to the Cyber Partisans, the hackers first gained access to Rosstat’s network about six months ago and spent the following four months quietly moving through its systems, collecting internal documents and expanding their access.

“We reached the agency’s critical systems while systematically extracting sensitive data and internal documents,” the group claimed.

The hackers said they began preparing for the destructive phase of the operation about a month ago, with the most intensive activity taking place over the past two weeks.

The attack culminated overnight on Saturday, they said, with the destruction of physical and virtual servers, along with large-scale data storage systems.

Silent Crow claimed the operation gave the hackers access to approximately 25,000 computers and other devices across Rosstat’s headquarters, regional offices and main statistical data processing center.

The group purported to have compromised systems used to manage the agency’s network, including domain controllers, virtualization platforms and infrastructure management tools. The hackers also said they breached databases containing economic, demographic and personal information, census records and internal government correspondence.

Among the allegedly stolen material were confidential mortality records detailing causes of death in Russia, as well as nonpublic statistics from Russian-occupied Ukrainian territories. The groups also claimed to have obtained information about Russian military casualties in the war against Ukraine.

The hackers’ claims about the scale of the breach, the destruction of infrastructure and the theft of sensitive data could not be independently verified. The Cyber Partisans said they planned to release a detailed account of the operation, along with samples of the allegedly stolen data, in the coming days.

The groups also claimed to have replaced content on Rosstat’s servers with official Ukrainian statistics on Russian military losses. They said the information remained publicly accessible for about an hour before the agency’s systems began experiencing disruptions.

Russian newspaper Kommersant reported that hackers had defaced Rosstat’s main website and regional portals, leaving messages that included a warning in Belarusian: “No one will escape accountability.”

A familiar alliance

This was not the first time the two hacking groups have joined forces to target major Russian organizations.

In July 2025, the Cyber Partisans and Silent Crow claimed responsibility for a disruptive cyberattack on Aeroflot, Russia’s flagship airline, which forced the carrier to cancel more than 100 flights and affected roughly 20,000 passengers.

The hackers claimed to have destroyed parts of the airline’s IT infrastructure and stolen sensitive information, including flight records, internal communications and employee monitoring data. They later published what they said were flight records belonging to Aeroflot’s chief executive.

The Cyber Partisans said Rosstat had proven to be a more difficult target than the airline.

“Unlike Aeroflot, which we attacked in 2025, Rosstat had a more robust security system,” the group said.

The Belarusian Cyber Partisans emerged following mass protests against President Alexander Lukashenko in 2020, after an election widely condemned by Western governments as fraudulent. The group has since carried out cyber operations targeting Belarusian and Russian government institutions.

In October, the group disclosed that it had infiltrated Moscow’s healthcare network in 2023, claiming to have gained administrator-level access to systems connected to other government agencies.

Silent Crow has also claimed responsibility for attacks on Russian government agencies and businesses, including an earlier breach of Rosreestr, the country’s state property registry.

In July, Russia’s Supreme Court designated both hacking groups as extremist organizations, effectively outlawing their activities in the country and exposing individuals associated with them to potential criminal prosecution. The practical consequences of the designation remain unclear, as the hackers have continued targeting Russian organizations.

“It looks like Rosstat will have to recalculate not only its statistics this time, but also the scale of its own problems,” Silent Crow said.