Rosstat: cyberattack confirmed; Cyber Partisans / Silent Crow claim wiper and data theft
Severity: high · Patch status: no-fix-needed · Since 2026-11-01
Rosstat, Russia's federal statistics agency, confirmed it was hit by a coordinated, carefully planned cyberattack, which reports date from 29 October. Its main website and regional portals were then defaced with messages from the Belarusian Cyber Partisans and pro-Ukrainian Silent Crow, as Kommersant reported. Rosstat says its monitoring caught the activity in time, that no databases or legally protected information were compromised, and that it is working with cybersecurity experts and law enforcement; it has given no figures. The groups' own claims, none of which any source has verified, are about six months of access, a destructive operation overnight on Saturday that wiped physical and virtual servers, about 25,000 devices including domain controllers and virtualization platforms, and theft of roughly 23 TB of economic, demographic, mortality, census and military-casualty data. Rosstat disputes the scale of the breach and the theft. Russia's Supreme Court declared both groups extremist in July 2026, and the groups claimed the July 2025 Aeroflot attack. No vendor fix applies; the practical actions are to assess exposure where you rely on Rosstat data feeds and to test backup and restore against wiper-style attacks on domain controllers and virtualization.
What to do
- Assess exposure only where you rely on Rosstat statistics or data feeds; treat the claimed data theft as unverified until a leak is shown
- Watch for the groups' promised sample release and check any published data against Rosstat's own releases
- Review backup and restore readiness against wiper-style attacks on domain controllers, virtualization and infrastructure management systems
- Harden infrastructure-management and virtualization tooling against long-dwell intrusions
Sources
All live incidents on Threat Watch
