Belarusian and Ukrainian Hackers Claim Major Cyberattack on Russia's Rosstat
A coalition of Belarusian and pro-Ukrainian hacktivist groups claims to have infiltrated and disrupted Russia's federal statistics agency, Rosstat, alleging extensive data theft and server destruction.
An alliance of Belarusian and pro-Ukrainian hackers has claimed responsibility for a significant cyberattack against Russia's federal statistics agency, Rosstat, asserting they spent months within its network before launching a destructive operation. The groups, identified as Belarusian Cyber Partisans and Silent Crow, stated on Sunday that their operation not only disrupted the agency's systems but also resulted in the destruction of servers and the theft of vast amounts of sensitive government data.
Rosstat has confirmed it was the target of a cyberattack, but it disputed the hackers' claims regarding the extent of the breach. The agency stated that its security systems detected and responded to suspicious activity in a timely manner, and it found no evidence that protected information had been leaked or its databases compromised. Rosstat is currently collaborating with cybersecurity experts and law enforcement to investigate the incident and identify the perpetrators.
The hackers allege that they gained initial access to Rosstat's network approximately six months prior to the attack. Over the subsequent four months, they systematically moved through the agency's systems, exfiltrating internal documents and expanding their access. The groups claimed to have compromised critical systems, including domain controllers, virtualization platforms, and infrastructure management tools, affecting an estimated 25,000 computers across Rosstat's various facilities.
According to the hackers' statements, the destructive phase of the operation was prepared over the past month, with intensive activity occurring in the two weeks leading up to the attack. The operation culminated over the weekend with the reported destruction of both physical and virtual servers, as well as large-scale data storage systems. The hackers also claimed to have replaced some of Rosstat's server content with Ukrainian statistics on Russian military losses, which remained publicly accessible for a short period before system disruptions began.
Among the most sensitive data allegedly stolen are confidential mortality records detailing causes of death in Russia, nonpublic statistics from Russian-occupied Ukrainian territories, and information pertaining to Russian military casualties in the ongoing conflict. The hackers also claimed to have obtained internal government correspondence. While these claims could not be independently verified, the groups indicated plans to release detailed accounts and data samples in the near future.
This is not the first coordinated operation between the Belarusian Cyber Partisans and Silent Crow. In July 2025, the two groups claimed responsibility for a disruptive attack on Aeroflot, Russia's flagship airline, which led to flight cancellations and affected thousands of passengers. The hackers stated that Rosstat presented a more challenging target due to its more robust security systems compared to Aeroflot.
The Belarusian Cyber Partisans emerged in the wake of the 2020 protests in Belarus and has since targeted various Belarusian and Russian government institutions. Silent Crow has also claimed responsibility for attacks on Russian entities, including the state property registry. In a significant development, Russia's Supreme Court designated both hacking groups as extremist organizations in July, though this has not deterred their continued operations against Russian targets.
The alleged attack on Rosstat, if confirmed to the extent claimed by the hackers, represents a significant breach of a critical Russian government agency responsible for sensitive demographic and economic data. The incident underscores the ongoing cyber warfare between Russia and its adversaries, with hacktivist groups playing an increasingly prominent role.