Illustrative image: Wikimedia Commons / BalticServers, CC BY-SA 3.0.
TL;DR — Rosstat hack 23 terabytes claimed explained in one line: two hacktivist groups say they broke into Russia's federal statistics agency between 29 October and 1 November 2026 and took around 23 terabytes of data, but Rosstat confirms only that its resources were attacked and denies any database was compromised or protected information leaked — so the 23TB figure is a claim, not a confirmed theft.
📌 KEY HIGHLIGHTS
- What happened: Rosstat, Russia's Federal State Statistics Service, was hit by cyberattacks from 29 October to 1 November 2026; its main website and regional pages were defaced with the attackers' logos and a Belarusian-language message.
- The claim: Belarusian Cyber Partisans and Silent Crow say they controlled about 25,000 computers and exfiltrated around 23 terabytes, including census material, economic and demographic statistics, and information on Russian military losses in Ukraine.
- The denial: Rosstat says its monitoring systems spotted suspicious activity in time for staff to respond, and that no databases or legally protected information were exposed.
- The gap: the two groups do not even agree on the volume — Cyber Partisans put it at more than 10 terabytes, Silent Crow at about 23 — and The Moscow Times says the claims could not be independently verified.
- What to watch: neither group has yet published specific casualty figures from the claimed haul; publication of samples would be the first real test of the claim.
Rosstat hack 23 terabytes claimed explained: what happened
Rosstat is Russia's federal statistics agency — the body that publishes the country's official numbers on population, prices, the economy and deaths. Between 29 October and 1 November 2026, its online resources came under sustained cyberattack, a timeline Rosstat itself gave to Russian outlets RBC and Kommersant. Visitors to the agency's main site and regional portals were greeted instead by defacement messages carrying the logos of the Belarusian Cyber Partisans and Silent Crow, with a line in Belarusian reading "No one will escape accountability". The main site was reported unreachable when the first stories went out on 1 November.
The groups' own statements, circulated in Telegram chats on 1 November, go far beyond defacement. Silent Crow says the operation reached Rosstat's central office, its regional branches and the Main Interregional Center for the Processing and Dissemination of Statistical Information — the hub that moves statistical data around the country. The group claims it took control of around 25,000 machines, reached domain controllers, and compromised virtualisation and infrastructure systems including ZVIRT, oVirt and VMware ESXi. The claimed haul, it says, includes databases with statistical, economic and personal information, census materials, roughly 2 terabytes of restricted-access documents, and information on Russian army losses in the war against Ukraine.
Claimed vs confirmed: the ledger
This is a story where the two sides agree on very little beyond the fact that an attack happened. Keeping the two columns separate is the whole point:
| Item | Claimed by the hackers | Confirmed or stated by Rosstat / independent outlets |
|---|---|---|
| Attack window | 29 October – 1 November 2026 | Same window, confirmed by Rosstat to RBC and Kommersant |
| Defacement | Messages and logos on Rosstat's main and regional sites | Confirmed — Kommersant saw the messages; the site went offline |
| Machines controlled | Around 25,000, including domain controllers | Not confirmed by any independent source |
| Data taken | About 23 TB (Silent Crow) / more than 10 TB (Cyber Partisans) | Denied — Rosstat says no database compromise or protected-information leak was found |
| Sensitive contents | Census data, personal information, military-loss figures, 2 TB of restricted documents | Unverified — The Moscow Times could not independently verify the claims; no specific figures published yet |
| Systems wiped | Databases, servers, virtualisation, document management, VPN, workstations | Not confirmed; Rosstat says monitoring caught the activity in time |
Illustrative image: Wikimedia Commons, CC BY 2.0.
Who are Cyber Partisans and Silent Crow?
The Belarusian Cyber Partisans are a Belarusian hacktivist collective opposed to Alexander Lukashenko's government; Silent Crow is a pro-Ukrainian hacktivist group that has worked alongside them before. Both are outlawed in Russia and designated extremist organisations there. Their record is mixed in a way that matters for judging this claim: some of their past claims were confirmed, others were denied and stayed unproven.
In July 2025 the two groups jointly claimed an attack on Aeroflot's IT systems that caused widespread flight disruption — Russian prosecutors confirmed that attack and opened a criminal investigation into unauthorised computer access. In January 2025 Silent Crow claimed to have taken 2 billion property-owner records from Rosreestr, Russia's state real-estate registry; Rosreestr denied a leak, but journalists confirmed some of the information the hackers made public. That history is why this Rosstat claim cannot be dismissed out of hand — and why it still cannot be accepted without evidence: the groups have a track record of real intrusions, but also of claims that outran what could be proved.
Why it matters for India readers
No India-specific fact is involved in this incident — no Indian system was targeted and no Indian data is named in the claims. The read-across for Indian readers is about how to treat breach news itself. First, defacement is not the same as exfiltration: taking over a public website's front page proves web access, not access to internal databases, and the two should never be reported as one event. Second, statistics agencies everywhere are high-value targets precisely because their numbers settle arguments — when a statistics agency stops publishing, as Rosstat did with its annual cause-of-death statistics in 2024, the vacuum invites competing claims that are hard to check. Third, if any of the claimed personal data does surface, the practical risk is follow-on phishing and impersonation using real names and details, so readers should treat unexpected messages citing "leaked" personal data with suspicion and verify through official channels. For context on how emergency-system attacks played out just a day earlier, see our Ukraine Air Alert app hack explainer, and for a breach where the company itself disclosed the incident, see our Chainalysis breach explainer and our Northflank breach explainer.
Should you care?
✅ Verdict: Yes, as a lesson in reading breach claims — not as a confirmed data disaster. The confirmed part (a multi-day attack and defacement of a federal agency's sites) is already significant. ⏳ But the 23TB headline rests entirely on the attackers' word, contradicted by the agency and unverified by independent outlets — treat it as an allegation until samples or forensic evidence appear.
FAQs
Did hackers really steal 23 terabytes from Rosstat?
Not confirmed. Silent Crow claims about 23 terabytes were exfiltrated and Cyber Partisans claims more than 10 terabytes, but Rosstat denies any database was compromised or protected information leaked, and The Moscow Times says the claims could not be independently verified. Until the groups publish verifiable samples, 23TB is a claim, not a fact.
What data do the hackers claim to have taken?
According to their statements, databases containing statistical, economic and personal information, population census materials, internal documents, about 2 terabytes of restricted-access documents, and information on Russian military losses in Ukraine. The groups have not yet published specific casualty figures from the claimed haul.
Who are the Cyber Partisans and Silent Crow?
The Cyber Partisans are a Belarusian hacktivist collective opposed to the Lukashenko government, and Silent Crow is a pro-Ukrainian hacktivist group that has collaborated with them. Both are outlawed in Russia and designated extremist organisations there. They previously claimed the July 2025 Aeroflot IT attack, which Russian prosecutors confirmed.
Has any of the claimed Rosstat data been published?
Not so far. Reports as of 2 November 2026 note that neither group has released specific figures from the trove, and no leaked dataset has been independently authenticated. Publication of samples — or a forensic statement from Rosstat — is what would move this story from claim to confirmed breach.
Takeaway: Rosstat confirms a multi-day attack and defacement; the 23-terabyte theft is so far only the attackers' claim, denied by the agency and unverified by independent outlets — watch for published samples before treating it as fact.
Follow World Tech on TechByCountry for tomorrow's update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
- Ukrinform, "Hackers breach Russia's statistics agency, obtain data on Russian losses in Ukraine" (2 November 2026)
- EconoTimes, "Hackers Claim 23 Terabytes Taken in Attack on Russia's Rosstat" (1 November 2026)
- LB.ua, "Cyberattacks Continue on Rosstat as Hackers Claim to Have Obtained Documents on Russian Army Losses" (1 November 2026)
- Brandefense, "Rosstat Hack: Claimed vs Confirmed" (1 November 2026)
Comments
Post a Comment