Summary
- Rosstat confirmed attacks against its systems between 29 and 31 October.
- Hackers claim to have stolen approximately 23 terabytes of information.
- The agency denies protected database access and the alleged leak.
Russia’s federal statistics agency has acknowledged a coordinated cyberattack against its systems while disputing hackers’ claims that they extracted approximately 23 terabytes of government information.
The Federal State Statistics Service, known as Rosstat, said its digital resources faced attacks between 29 and 31 October. Security personnel detected suspicious activity and took steps to protect its information systems, according to the agency.
Groups calling themselves the Belarusian Cyber Partisans and Silent Crow claimed responsibility. Messages linked to those groups appeared on the agency’s main site and regional web portals during the period of disruption.
The attackers alleged that they obtained large quantities of internal information covering statistical and economic records, demographic datasets, and documents associated with Russia’s war in Ukraine. Their stated 23-terabyte figure has not been independently authenticated.
Rosstat denied that its protected databases had been compromised or leaked. It said specialists were investigating the attack path and working with relevant authorities to establish responsibility.
The competing accounts leave a substantial gap between the confirmed disruption and the scale of the alleged theft. Public interference with a website does not, on its own, demonstrate access to underlying databases maintained on separate infrastructure.
Statistical agencies maintain collections of information used for policy, economic analysis, population studies, and public services. Interference with official data systems can affect confidence in the availability and integrity of material relied on by government and researchers.
At the same time, the sensitivity of data mentioned in an attackers’ claim does not establish that the files exist or that they originated from the stated victim. Documents circulated after an intrusion may be unrelated, manipulated, or acquired elsewhere.
An independently verified account of a large-scale data theft would require evidence connecting the files to Rosstat’s systems, showing how they were obtained, and establishing whether the reported volume represents unique stolen information.
Cyber incidents involving public agencies often produce different forms of evidence at different stages. A changed website, unavailable portal, or malicious message may be obvious to outside observers, while internal unauthorised access requires logs and forensic records that are not publicly available.
The distinction is particularly important when alleged attackers publish claims during an ongoing investigation. Statements can be intended to increase political visibility or pressure an organisation regardless of the verified technical consequences.
Rosstat operates in a politically sensitive environment because official economic and demographic figures can inform assessments of policy, public expenditure, and the effects of Russia’s continuing military campaign.
The identity claims made by Belarusian and Ukrainian-linked groups provide context for how the event has been presented publicly, but group names are not proof that the stated actors controlled every stage of the operation.
Attribution could depend on examination of access records, compromised credentials, servers involved in the intrusion, and communications associated with the attack. The agency has not released technical findings sufficient to establish a complete route into its systems.
Government services may also rely on hosting providers and regional administrative platforms. An attack on a public-facing component can create disruption without giving access to every linked application or protected dataset.
Rosstat’s response indicates that it was assessing both the availability of services and the integrity of its information. The public record does not establish the total operational impact or whether any regional systems were separately compromised.
For the agency, restoring normal service is one task; reconciling the hackers’ allegations with forensic evidence is another. The latter is necessary before claims about stolen records or the absence of data loss can be fully evaluated.
The incident remains an acknowledged attack accompanied by disputed allegations of extensive data theft. Neither the claimed volume nor the full technical scope has been verified publicly.
