Rosstat Says Cyberattack Hit Its Websites but No Databases Leaked

Russia’s federal statistics service has confirmed a Rosstat cyberattack lasting several days, while saying its defences did their job. Rosstat says “targeted destructive cyberattacks” were recorded against its information resources from 29 October to 1 November, but that no databases were compromised and no legally protected information leaked. Two hacking groups that put their own messages on its website claim far more damage, and those claims have not been verified.

“The infrastructure worked as intended: monitoring systems promptly warned of suspicious activity, which allowed a response to begin quickly,” Rosstat said in a statement reported by Interfax, in TSN’s translation. Specialists, working with information-security units and law enforcement, are now “establishing the attack vector and identifying the sources of the threat”, it said, and access to its official website “will be restored in the near future”.

What Rosstat says about the Rosstat cyberattack

Rosstat collects and publishes Russia’s official figures on population, prices and the economy, and runs offices in every region. That makes it a large target with many entry points. According to the Moscow Times, which cited Rosstat’s comments to the RBC news site, the agency described the attacks as carefully planned, aimed at several areas at once and carried out from a wide range of locations.

The defacement itself is on the public record. A Wayback Machine capture of Rosstat’s front page, taken at 03:08 UTC on 1 November, shows the normal site replaced by a Belarusian-language banner reading “No one will escape accountability” and the logo of the Cyber Partisans. The Moscow Times said messages from both groups appeared on the main site and on regional portals.

What Rosstat has not said is how the attackers got in, which systems were affected or whether any of its statistical work has been disrupted. It says the investigation into the attack vector is still under way.

What the hacking groups claim

The groups’ accounts go much further, and they have not been independently verified. In a post on Telegram at 06:12 UTC on 1 November, Silent Crow said it had controlled “about 25,000 machines”, reached domain controllers at Rosstat’s central office, its regional offices and its main data-processing centre, and compromised virtualisation and infrastructure management systems, including VMware ESXi and oVirt. It says it took “about 23TB” of data in total, including about 2TB of documents from a restricted network.

The Belarusian Cyber Partisans, in a post at 09:00 UTC, say they wiped databases, servers, the virtualisation environment, document systems, workstations and VPN access, and that the data they took exceeds 10TB. Both groups also say the material includes information on Russian military losses. TSN has not seen any of the data and is not repeating those figures.

Both groups are designated as extremist and banned in Russia, the Moscow Times reported. They also claimed a July 2025 attack on Aeroflot, after which Russian prosecutors confirmed a cyberattack had taken place.

Why the claims and the denial cannot both be tested yet

There is a wide gap between the two accounts, and neither side has published evidence that settles it. Rosstat’s statement is specific on one point: it says it found no compromise of its databases and no leak of legally protected information. It does not deny that its systems were damaged, and its website was still down on Sunday. The groups, for their part, have so far published claims and a defaced web page, not the data itself, and their two totals differ: more than 10TB in one post, about 23TB in the other.

That leaves defenders with the parts that can be checked. A defacement on the main site and regional portals shows the attackers had write access to public-facing systems. The groups’ claims to have reached domain controllers and virtualisation platforms point to the same layers that other recent intrusions have targeted. TSN reported this week that CISA added a VMware ESXi logging flaw that the China-linked Warp Panda group had used as a zero-day to its exploited-vulnerabilities list. When hypervisors and directory services are compromised, an attacker can wipe many machines at once, which is why separate, offline backups and tight control of administrator accounts matter so much for public bodies.

Politically motivated attacks on state institutions are a recurring pattern, from the hacks of Bulgaria’s public broadcasters to the Syrian Electronic Army case, and they often come with large public claims made early. The test here is what Rosstat restores, and how quickly, and whether any of the claimed data appears in a form that can be checked. TSN tracks these incidents on its ransomware and cyber attacks hub.

What comes next

Rosstat says its website will be back soon and that the attack vector is being investigated with law enforcement. The Cyber Partisans say more details will follow. Until either side publishes evidence, the size of any data loss remains a matter of claim and denial.

Sources

• Interfax: Rosstat statement on cyberattacks, 29 October to 1 November 2026 (in Russian)
• Wayback Machine: capture of rosstat.gov.ru, 1 November 2026, 03:08 UTC
• Silent Crow on Telegram, 1 November 2026, 06:12 UTC (in Russian; claim)
• Belarusian Cyber Partisans on Telegram, 1 November 2026, 09:00 UTC (in Russian; claim)
• The Moscow Times: Russia’s Statistics Agency Hit by Cyberattack as Hackers Claim Massive Data Theft
• Kommersant (in Russian)

Related stories

• CISA Lists ESXi Logging Flaw China-Linked Warp Panda Used as Zero-Day
• Bulgarian Teen Held Over BNT and BNR Hacks as Defence Disputes Link
• Syrian Electronic Army Hacker Gets 42 Months for Pro-Assad Attacks

Image: toiida / Wikimedia Commons, CC0, modified by TSN