The Belarusian hacker group “Cyberguerrilla“ and the Silent Crow collective have claimed to have carried out a large-scale cyberattack on Russia's Federal State Statistics Service, known as “Rosstat“. They claim to have gained access to the agency's central office, its regional branches and the Main Interregional Center for Processing and Dissemination of Statistical Information.
The hackers claim to have gained control of about 25,000 computer configurations and servers. They also reported the download of nearly 23 terabytes of data, including internal documents, databases, official state information and files from employees' work computers.
„The main volume is databases, internal documents, official information and data from employees' work computers. The scale of the event goes far beyond the compromise of individual servers or user accounts“, the hacker organizations stated.Among the most sensitive allegations is that the downloaded array contains data on Russian military losses in the war against Ukraine. The hackers indicate that they gained access not only to individual public resources, but also to central and regional systems of the Russian statistics service. However, these allegations have not been independently confirmed.
„Rosstat“ confirmed the attack, but denied the leak
„Rosstat“ confirmed that cyberattacks were carried out against its information resources between October 29 and November 1. According to the Russian service, the attacks were coordinated and affected the federal website and regional portals.
The agency denies that any database or other protected information was leaked. “Rosstat“ states that monitoring systems detected suspicious activity, which allowed employees to react. There is currently no public confirmation that the claimed 23 terabytes of data were actually exported.
The logos of the two groups and a message in Belarusian have appeared on the websites of “Rosstat“ and its regional branches: “No one can escape responsibility“. Merely changing the content of a public site proves interference with a web resource, but does not automatically confirm access to internal databases.
The groups have also been linked to the attack on „Aeroflot“
„Cyberpartisans BY“ and Silent Crow also claimed responsibility for a large-scale attack on „Aeroflot“'s IT systems in July 2025, which led to serious disruptions in the airline's operations and the cancellation of dozens of flights.
In July 2026, the Supreme Court of Russia declared the two groups extremist organizations and banned their activities on the territory of the country. In the case of „Rosstat“ It remains to be determined what the real scope of the intrusion is, whether internal arrays were copied and whether there was any damage to the information infrastructure.
Sources: news.bg, bfm.ru, themoscowtimes.com