Russia Hid Its War Dead Until Hackers Raided Rosstat

Rosstat, Russia's federal statistics service, says its databases were never compromised and no protected information left its network. Two hacker groups say they spent six months inside, stole about 23 TB, and destroyed much of the agency's internal infrastructure on the way out. A week after the attack, Bloomberg was reviewing a dataset of more than 11 million Russian death certificates drawn from the leak, and about 392,700 of them referenced the war.

The Belarusian Cyber Partisans and the pro-Ukrainian Silent Crow announced the operation on November 1 by defacing Rosstat's federal and regional portals with a message in Belarusian, "No one will escape accountability." For about an hour, the main site displayed Ukrainian figures on Russian military losses, according to Kommersant reporting cited by The Record. Rosstat acknowledged targeted cyber attacks between October 29 and November 1 and restored the site by morning.

The Kremlin has published no official count of its war dead since September 2022, and Rosstat stopped releasing annual cause-of-death statistics in 2024. The records Moscow kept for itself are now in the hands of the people fighting it.

Admissions Versus Claims

Rosstat's own statements confirm more than its denial suggests. The agency told RBC and Kommersant the attacks were "carefully planned," hit several areas at once, and involved specialists working from many locations. By November 5 it said its website was restored, but Vedomosti reported segments of the IT infrastructure remained isolated for security checks and would return in stages. Rosstat extended the deadline for companies' primary statistical submissions to November 13 and warned publication dates could slip.

The disruption reached the public data service. Verstka found most statistics published as Excel files on Rosstat's website returned a "document not found" error after the attack, while PDFs and archived data remained available. Two weekly price releases missed their Friday deadline and were postponed repeatedly, Bloomberg reported. A defacement of one web server does not explain delayed inflation data, isolated internal infrastructure, and widespread failures to retrieve statistical files.

The hackers' claims remain far larger than anything confirmed. Silent Crow says it controlled about 25,000 machines and compromised domain controllers in the central office and regional divisions. It also claims access to VMware ESXi, oVirt, and zVirt virtualization environments. Cyber Partisans claimed more than 10 TB exfiltrated while Silent Crow claimed about 23 TB, a gap Brandefense documented. Dmitry Shchigelsky, a contact person for the Cyber Partisans, told Radio Svoboda the combined figure may include duplicated data from the joint operation. He also said a substantial portion of Rosstat's information was destroyed.

Shchigelsky argued Russia's own data localization rules made the destruction easier by concentrating government data inside the country. The claim remains his assessment, not a verified description of Rosstat's recovery architecture. zVirt is a Russian virtualization platform marketed as a domestic replacement for Western products. If the attackers reached several virtualization management environments, they may also have reached systems supporting recovery. Geographic localization alone would not explain a catastrophic loss. The decisive weakness would be backup copies accessible through the same compromised administrative privileges.

Neither side has disclosed the initial access mechanism. The groups describe an intrusion beginning about six months before the attack. Four months of quiet movement and collection allegedly followed, then preparation for the destructive phase and two weeks of intensive activity before the claimed wipe overnight on October 31.

Rosstat says its monitoring detected suspicious activity in time for specialists to respond. Both accounts could be accurate if the agency detected the final attack rather than the initial intrusion. The unresolved question is how long unauthorized access continued before Rosstat recognized it.

I assess with high confidence the intrusion reached beyond Rosstat's public website. Internal isolation, missing statistical files, and delayed releases support the judgment independently of the hackers' claims. I assess with moderate confidence substantial internal datasets were obtained, given the mortality records examined by Bloomberg and The Guardian. The alleged 23 TB volume, 25,000 compromised machines, and extent of deliberate destruction remain at low confidence.

Eleven Million Death Certificates

Bloomberg's review identified approximately 392,700 death certificates linked to the war through official cause codes or descriptions such as "military operation," "shelling," and "drones." The certificates covered deaths registered between February 24, 2022, and late August 2026. Bloomberg found metadata consistent with a genuine government export and no apparent signs of fabrication. Overall death totals differed from Rosstat's published figures by 0.1 percent for 2021, 0.2 percent for 2022, and about 1 percent for 2023.

The Guardian examined the leaked records and reported 412,576 war-linked certificates, approximately 19,900 more than Bloomberg. Both newsrooms described identifying records through official codes and written references to military operations, yet neither published a sufficiently detailed reconciliation of its inclusion rules to explain the difference.

The discrepancy is approximately 5 percent of Bloomberg's count. It could reflect different search terms, classifications, treatment of ambiguous records, or versions of the supplied data. Those explanations remain untested. Two newsrooms examining the same compromised collection do not provide independent authentication merely because their totals are broadly similar. Their findings are most valuable where their methods can be checked against sources outside the leak.

The two hacker groups also published different totals. Cyber Partisans counted 393,881 deaths through August 27, 2026, while Silent Crow reached approximately 450,000 by including additional categories. Those included non-combat military deaths, deaths associated with terrorist acts, and some records from occupied territories without stated causes. Its figure also includes civilians killed in Russian territory and occupied Ukraine, according to The Moscow Times. The totals measure overlapping but different populations. None should be presented as a definitive count of Russian soldiers killed in combat.

The leak sits near several independent estimates, although their populations and cutoff dates differ. Mediazona and BBC News Russian had identified approximately 286,000 named Russian military dead by early November. Mediazona and Meduza used inheritance registry data to estimate approximately 352,000 deaths among men aged 18 to 59 through the end of 2025. CSIS estimated 400,000 to 450,000 Russian troops killed through June 2026. Moscow's last official figure, 5,937 dead, came from then-Defense Minister Sergei Shoigu in September 2022.

Registration delays shape every comparison. Bloomberg found the median gap between death and registration rose from about six weeks in the second half of 2023 to more than four months in 2025. Over 2,500 war-related deaths from 2025 entered the register only in August 2026. Soldiers declared missing remain absent until a court establishes their deaths. Janis Kluge of the German Institute for International and Security Affairs said the true total is probably closer to 500,000 than 400,000.

The chronology also reveals something a national total cannot. The Guardian reported recorded war-related deaths exceeded 15,000 in several months during late 2024 and 2025, according to Kluge's examination. A surge in recorded fatalities can reflect intensified fighting, delayed administrative processing, or both.

The geography exposes a deeper domestic imbalance. Between February 2022 and mid-2024, war-related fatalities represented roughly one-third of all recorded deaths among men aged 18 to 49 in Buryatia, Tuva, and Zabaykalsky Krai. In Moscow and St. Petersburg, the equivalent share was approximately 10 percent. The comparison measures the proportion of deaths within the specified population, not the proportion of residents killed. It shows how unevenly the war has consumed Russian communities.

Arguments for Doubting the Leak

Rosstat denies any database compromise, and the hackers are participants in a war with incentives to inflate Russia's losses. A Rambler commentary published hours after the defacement argued a changed web page proves nothing about access to internal databases. It noted the July 2025 Aeroflot disruption was real while claims concerning stolen data and destroyed servers remained incompletely verified.

Larry Johnson, a former CIA analyst and frequent critic of Western policy on Ukraine, called the leak a probable influence operation. He argued its timing diverted attention from a Finnish National Defence University analysis suggesting Ukrainian deaths far exceeded Russian losses. I could not independently verify the cited Finnish assessment, so it remains part of Johnson's argument rather than an established finding. He also contended matching names from Mediazona's published casualty records could be accomplished by someone fabricating a database.

The strongest evidence against wholesale fabrication comes from the structure of the records. Bloomberg found metadata consistent with an authentic export and annual mortality totals closely matching Rosstat's earlier publications. The Moscow Times cross-checked a sample of 50 named casualties against the leaked material. Reproducing millions of coherent administrative records would require considerably more than copying names from public obituaries.

A genuine database can still support a misleading analysis. Selective release, altered entries, inconsistent casualty definitions, and omitted records can distort conclusions without fabricating an entire dataset. Cyber Partisans and Silent Crow controlled access to the files, and Shchigelsky described a two-month publication moratorium for journalists receiving access. Their cooperation enabled examination by outside reporters while preserving influence over which information entered public debate and when.

The records also complicate claims favorable to Kyiv. Meduza's February investigation found estimates approaching 50,000 Russian deaths per month relied on obituary counts distorted by court declarations of soldiers previously listed as missing. Meduza estimated roughly 27,000 monthly irreversible losses, a broader category including permanent incapacitation.

The Guardian's finding of months exceeding 15,000 deaths provides a more grounded comparison, although the figures cannot be treated as identical measures. Death certificates record registered deaths, while irreversible losses include other outcomes. Reconstructing losses by the actual date of death, rather than the date a certificate entered the register, is necessary before drawing conclusions about changing battlefield lethality.

I assess with moderate confidence the leaked death-record collection is substantially authentic. I hold any single published total as an accurate count of Russian military deaths at low confidence. Civilian casualties, differing classifications, missing personnel, and registration delays prevent the available figures from resolving into one definitive military death toll.

Who Gains From Rosstat's Data

Kyiv's Targeting Data

Shchigelsky told Radio Svoboda the economic databases matter more than the mortality records. He identified production and import information involving bearings, electronic components, and other industrial goods. Such data helps Ukrainian analysts identify sanctions-evasion routes, supply dependencies, and industrial facilities supporting Russia's military production. He described translating the findings into what he called "kinetic sanctions," meaning physical attacks on targets exposed through economic intelligence.

The hackers also claim access to nonpublic statistics from occupied Ukrainian territories. If verified, the material could improve Ukraine's understanding of Russian logistical and industrial activity beyond publicly visible infrastructure. The intelligence value would depend on the records' completeness, currency, and geographic precision.

Minsk's Opposition Strikes the Patron

The Cyber Partisans emerged in September 2020 following Belarus's disputed presidential election and work alongside BYPOL, an organization formed by former Belarusian security personnel. Their operations expanded from Lukashenko's institutions toward Russia, whose military and political support sustains his government. The Belarusian Railway disruption in January 2022, the Aeroflot attack, and now Rosstat form part of that progression.

Russia's Supreme Court designated both Cyber Partisans and Silent Crow extremist organizations on July 21, 2026. The designation increases legal consequences for participants and supporters without necessarily reducing the ability of anonymous members operating outside Russia to continue their activity.

The Belarus dimension runs in both directions. ESET's latest reporting identified Belarus-aligned threat actors acting as Russia's cyber proxies, including destructive activity against a Ukrainian manufacturer. The reporting period overlapped the months Cyber Partisans claim they occupied Rosstat's systems. Belarusian dissidents and Belarus-aligned pro-Russian threat actors are operating on opposing sides of the same conflict, reflecting political divisions hidden by descriptions of Belarus as Moscow's ally.

Western Analysts Get an External Check

Western governments estimate Russian losses through satellite imagery, intercepted communications, military reporting, and open sources. British intelligence estimated roughly 500,000 Russian soldiers had been killed by September, according to The Guardian. A government mortality register could provide an unusually valuable external check on those assessments.

The hackers still control the release, and two politically committed hacking collectives decide which journalists see a major casualty dataset and when. Analysts must therefore assess the information and its custodians separately.

Negotiations Meet the Disclosure

The hackers released their casualty analysis over the weekend preceding the November 10 US-brokered negotiations in Abu Dhabi. The timing placed new evidence of Russian losses into the public debate immediately before American, Russian, and Ukrainian representatives resumed substantive talks. It created an opportunity to influence political expectations about Moscow's tolerance for continued fighting and the costs of rejecting an agreement.

The timing does not establish coordination with Kyiv's negotiators or a deliberate attempt to alter the talks. Nor does public exposure necessarily increase pressure for compromise. The Guardian quoted a person familiar with Vladimir Putin's thinking who argued the losses would harden his resolve rather than encourage concessions. A disclosure can be intended to weaken an adversary's negotiating position while reinforcing the adversary's determination to continue. The political effect of the disclosure rests on Moscow's interpretation of the losses more than on the strength of the evidence.

Moscow Gets an Alibi

The breach also gives Rosstat a convenient explanation for missing files, delayed price data, and future interruptions to statistical releases. The attackers' own claims of extensive destruction strengthen the explanation. Rosstat had already stopped publishing monthly births and deaths and withdrawn numerous datasets from public access before the intrusion.

I assess with moderate confidence Moscow will use the incident to justify additional restrictions on statistical access. The precedent lies in its existing publication policies, while the attack supplies a new security rationale. Further limits on services such as the EMISS statistics portal would reduce independent visibility into Russia's economy and population at precisely the moment external analysts need reliable measurements.

Counter-intelligence Value of the Dead

Eleven million death records form an identity resource as well as a mortality database. Age, residence, date of death, cause of death, and location help intelligence services test claims about individuals, military losses, or movements between jurisdictions. The Moscow Times' comparison against named casualty records shows at least some leaked material matches identifiable people, although copies supplied to different recipients may contain different fields.

Death records also support the construction and verification of cover identities. Intelligence services have historically exploited the identities of deceased people, and a government registry helps identify discrepancies between a claimed personal history and official records. The public evidence does not show the attackers pursuing this objective. I hold it at low confidence as a purpose of the Rosstat operation, while assessing the potential counter-intelligence utility of the information as credible.

Hacktivists, Proxies, or Both

Silent Crow's Telegram channel appeared in late December 2024, and its origins remain undisclosed. Its record includes the January 2025 Rosreestr breach, where journalists verified sample records belonging to real people despite the registry's denial. It also claimed the July 2025 Aeroflot attack with the Cyber Partisans. Official denial followed by partial outside verification has occurred in earlier cases, and Rosstat's statements warrant examination against the same standard.

The Cyber Partisans have developed more sophisticated tradecraft. Solar 4RAYS, the threat research unit of Rostelecom's cyber security subsidiary, published an investigation in October into an activity cluster it calls Partisan Zmiy, which it associates with Cyber Partisans. The threat actor maintained access to a Russian healthcare organization for approximately two years without destructive activity. Solar documented a Vasilek backdoor controlled through Telegram, compromised VMware Tools components, DNS tunneling, and GOST proxy tunnels.

The healthcare organization maintained trusted connections with numerous medical subsidiaries. Solar assessed continued access may have been valuable for intelligence collection and future operations against those connected organizations. The intrusion demonstrates a willingness to preserve access when the resulting intelligence opportunities outweigh immediate disruption.

Rosstat presents a different claimed objective. After months of collection, the attackers say they deliberately destroyed infrastructure and surrendered continued access. If accurate, the choice sacrificed a valuable intelligence position for disruption and public exposure. It may also have interrupted the production of future statistical records. The contrast suggests the Cyber Partisans can pursue persistent collection and destructive operations according to different objectives. It does not identify who authorized the Rosstat attack.

The Solar investigation also helps define the attribution limits. It documents Vasilek, DNS tunneling, Windows service persistence, credentialed remote access, and other techniques in an earlier intrusion attributed to Partisan Zmiy. No public technical investigation has demonstrated those same tools or artifacts inside Rosstat. Shared organizational attribution should not become a substitute for matching forensic evidence.

If the Rosstat intrusion reached the scope claimed by Silent Crow, it would represent an operation of considerable complexity against a distributed federal institution. The claimed scale resembles the Aeroflot claims of July 2025, when Silent Crow said about 7,000 servers were destroyed, and neither set of claims has been forensically verified. Ukraine's military intelligence directorate, HUR, has conducted and claimed cyber operations against Russian institutions, but no public evidence connects it or another state service to Rosstat. I assess with low confidence a state intelligence service supported the operation.

Moscow faces its own attribution dilemma. Calling the attackers independent hacktivists concedes volunteers compromised a federal agency. Attributing the operation to foreign intelligence gives the incident greater strategic significance and could invite questions about the records reportedly obtained. Russia has conducted destructive intrusions against Ukrainian institutions for years, including VOODOO BEAR's attack on a Ukrainian grain company. Rosstat now confronts allegations of comparable destructive activity against its own systems.

Russia removed its war dead from public view one dataset at a time, but civil registration continued and the government retained the information required to administer the country. Every restriction on public access increased the intelligence value of the internal records. The alleged intrusion transformed those records into a resource for Ukrainian military analysis, Belarusian opposition activity, independent casualty estimates, and possible counter-intelligence collection.

If further examination confirms the integrity of the leaked data, Rosstat's compromise will have exposed more than the human cost of Russia's invasion. It will also have handed two hacking collectives the power to decide which Russian numbers the world sees, a power the Kremlin spent four years reserving for itself. A government hiding its losses from its own citizens built the intelligence target its adversaries sought to penetrate.

Analyst Annex

Evidence status as of November 11, 2026.

Intelligence Gaps

Entities

MITRE ATT&CK Mapping

No procedure has been published for initial access, privilege escalation, lateral movement, or exfiltration at Rosstat, so none is mapped.

Indicators

No technical indicators from the Rosstat intrusion have been published.

Related Activity

The techniques below come from Solar's October 2026 report on the Partisan Zmiy intrusion at a Russian healthcare organization. None has been observed at Rosstat.

File hashes, domains, and IP addresses for this intrusion are in Solar's report.