An alliance of Belarusian and pro-Ukrainian hacking groups claims to have breached and partially destroyed the IT infrastructure of Rosstat, Russia’s federal statistics agency, in an operation it says culminated in a destructive wipe of servers over the weekend.
The Belarusian Cyber Partisans and the pro-Ukrainian group Silent Crow said they first gained access to Rosstat’s network roughly six months ago and spent four months moving laterally through its systems, collecting internal documents and expanding access before beginning preparations for a destructive phase about a month ago. The most intensive activity, they said, took place over the past two weeks, culminating overnight on Saturday in the destruction of physical and virtual servers and large-scale data storage systems.
Rosstat confirmed it had been targeted but disputed the scope of the claims, telling Russian state news agency TASS that its security systems detected suspicious activity in time for specialists to respond and that it found no evidence protected information was leaked or its databases compromised. The agency said it is working with cybersecurity experts and law enforcement to identify the source of the attack.
Scale of the claimed breach
Silent Crow said the operation gave the hackers access to roughly 25,000 computers and devices across Rosstat’s headquarters, regional offices and main statistical data processing center, including domain controllers, virtualization platforms and infrastructure management tools. The groups claimed to have exfiltrated economic, demographic and personal data, census records, internal government correspondence, confidential mortality records, and nonpublic statistics from Russian-occupied Ukrainian territories, as well as information on Russian military casualties.
The hackers said they briefly replaced content on Rosstat’s servers with official Ukrainian statistics on Russian military losses, which remained accessible for about an hour before systems began experiencing disruptions. Russian outlet Kommersant reported that Rosstat’s main website and regional portals were defaced with messages including a Belarusian-language warning. None of the claims about the scale of the breach or data theft have been independently verified; the Cyber Partisans said they plan to release further details and data samples.
A recurring partnership
The two groups previously claimed joint responsibility for a July 2025 attack on Aeroflot that canceled more than 100 flights and affected about 20,000 passengers. The Cyber Partisans said Rosstat’s defenses were notably stronger than Aeroflot’s. Both groups have also separately targeted other Russian institutions, including Moscow’s healthcare network and the Rosreestr property registry. In July, Russia’s Supreme Court designated both groups as extremist organizations, though the designation has not stopped their continued operations.
