The Rosstat cyberattack has thrust a long-hidden category of information into public view: Russian military casualty figures from the war in Ukraine. Hackers associated with the groups Silent Crow and Belarusian CyberPartisans say they breached the federal statistics agency’s systems and posted data on a state website, while also claiming to have removed roughly 23TB of material.
Rosstat acknowledged that its servers were targeted over the Halloween weekend, but its account differs sharply from the hackers’ claims. The agency said monitoring systems flagged suspicious activity promptly and that its infrastructure continued to operate normally. It also stated that no compromising databases or leakage of legally protected information had been identified.
What the hackers say they took
According to messages published on Telegram, the intruders describe gaining access to a substantial portion of Rosstat’s IT infrastructure. Their account covers the central office, regional units and the Main Interregional Center for the Processing and Dissemination of Statistical Information. The groups say the operation went beyond isolated servers or user accounts and reached central and regional systems, internal circuits and data sets of public and official value.
They further claim that access to domain controllers opened the way to core organizational data. From there, they say, they compromised virtualization systems, including VMware ESXi, as well as infrastructure management systems. The groups also asserted that they took control of vehicles, though the source material does not elaborate on that point.
Rosstat’s confirmation made no mention of data exfiltration. Instead, it said cybersecurity specialists, on-site experts, specialized information security units and law enforcement agencies were working to establish the attack vector and identify the sources of the threat.
Casualty figures surface
The most sensitive material said to have been exposed concerns Russian military personnel losses. The hackers put the number of human casualties since the start of the war at 1,584,910. They also cited a loss figure of 587,409 UAVs, a category of combat asset that the data indicates is used far more heavily than tanks, artillery or manned aircraft.
Russian casualty figures have been kept under wraps since 2024, and official sources in Russia are unlikely to verify the numbers now circulating. The breach therefore leaves the public with unverified figures attributed to the hackers rather than to any confirmed government release.
Agency response and open questions
Rosstat’s public statement emphasized that its information resources were targeted and that response measures began quickly after monitoring systems raised alarms. The agency did not confirm the theft of 23TB of data, a figure that comes from the hacker groups themselves.
The episode highlights the gap between an official denial of data loss and the hackers’ detailed account of penetrating a federal department’s central and regional systems. Rosstat has not addressed the specific claims about domain controllers, virtualization platforms or vehicle access. Its confirmation focused on the absence of identified leaks and on the ongoing investigation into how the attack occurred and who was behind it.
For now, the casualty numbers and the scale of the alleged data haul remain claims made by the intruders. Rosstat’s acknowledgment of a cyberattack is the firmest official fact, while the rest of the rests on the hackers’ Telegram statements and their assertion that 23TB of documents and databases were taken.
