On 1 November 2026 two hacktivist groups, Belarusian Cyber Partisans and Silent Crow, said they had destroyed the internal systems of Rosstat, Russia’s federal statistics service. Rosstat confirmed that its resources were under attack, but it says no databases or protected information leaked. The wipe and the stolen data volume rest only on the groups’ own posts.
This article separates what the groups claim from what Rosstat and outside sources confirm, explains who the groups are and why a statistics agency is an attractive target. We link to no leaked data and name no person.
What Did the Groups Claim?
According to a post in a chat named “Cyber Partisans” on 1 November, the groups wiped Rosstat’s databases, servers, virtualization environment, document management, workstations and VPN. The post names core statistical systems, says material marked as a state secret was taken, and puts the volume at more than 10 TB. It also says the groups posted Ukrainian figures on Russian war losses on the Rosstat website.
Silent Crow’s own statement, a copy of which appeared in another Telegram chat at 10:30 UTC, goes further. It claims control of about 25,000 machines, access to domain controllers in the central office and regional divisions, and compromise of ZVIRT, oVirt and VMware ESXi. It puts the total exfiltrated at about 23 TB, including roughly 2 TB from a restricted-access document perimeter.
- Date.
- Defacement overnight into 1 November 2026; Rosstat dates the attacks 29 October to 1 November.
- Claimed by.
- Cyber Partisans (Belarus) and Silent Crow.
- Claimed data.
- More than 10 TB (Cyber Partisans) and about 23 TB (Silent Crow).
- Claimed damage.
- Wiped databases, servers, virtualization, VPN and workstations.
- Rosstat’s position.
- Attack confirmed; no database compromise or leak of protected information found.
- Independent verification.
- The Moscow Times says the claims could not be independently verified, as of 1 November.
Claim Ledger: What Is Confirmed and What Is Not
Kommersant reported messages on the federal section and regional pages of the Rosstat site, with both groups’ logos and a Belarusian line, “No one will escape accountability”. Rosstat told Kommersant and RBC that it recorded attacks from 29 October to 1 November. The RBC account calls them carefully prepared, multi-directional and staffed by many specialists.
| Point | What the groups say | What Rosstat and outside reporting say |
|---|---|---|
| Defacement | Messages and logos placed on Rosstat sites | Confirmed: Rosstat acknowledged attacks on its resources, and Kommersant saw the messages |
| Wipe of internal systems | Databases, servers, virtualization and VPN destroyed | Rosstat told Kommersant its infrastructure worked normally; the wipe is not independently verified |
| Data volume | More than 10 TB in one post, about 23 TB in another | Not verified; The Moscow Times says the claims could not be independently verified, and Zona Media, citing RBC, reports them as the hackers’ claim |
| Content of the data | State-secret material, personal data and war-loss figures | The Moscow Times says the claims could not be independently verified |
| Data leak | The groups promise to publish part of the data | Rosstat says it found no database compromise and no leak of protected information |
The two volume figures are the groups’ own, and their posts do not explain the gap. Rosstat’s denial is also its own statement, not an audit. Until a third party examines files or logs, both sides of the leak question stay unverified.
Who Are Cyber Partisans and Silent Crow?
Cyber Partisans is a Belarusian group. Meduza reported on 21 July 2026 that Russia’s Supreme Court, on a Prosecutor General suit, declared it and Silent Crow extremist organizations. TASS said, citing the court, that Cyber Partisans belong to the Belarusian opposition structure Supraciu, while the court called Silent Crow a pro-Ukrainian association of politically motivated hacktivists.
The record of the two groups mixes confirmed damage with unverified claims. In November 2022 Risky Biz reported that Cyber Partisans claimed to have wiped a domain controller at a Roskomnadzor sub-agency, which confirmed a breach to Kommersant. In October 2026 the Russian firm Solar published research that ties a stealthy espionage cluster to Cyber Partisans. See Solar’s report on Partisan Zmiy: it describes about two years inside a Russian medical network without any destructive step.
Silent Crow opened its Telegram channel in December 2024 and claimed the Rosreestr property registry in January 2025. Rosreestr denied a breach, yet journalists checked a dozen sample entries and found them genuine, according to The Record. In July 2025 the two groups claimed the Aeroflot attack; Silent Crow said 7,000 servers were destroyed, and Meduza cites Atorus counting 108 cancelled flights on 28 July. The Moscow Times says prosecutors confirmed an attack and opened a criminal case.
That history teaches one habit: claims of destruction and theft from these groups need checking, but the access behind them has sometimes been real. For the wider picture of ideology-driven groups, see our summary of ENISA’s hacktivism findings for 2025 and our glossary entry on hacktivism.
Why Go After a Statistics Agency?
A statistics office holds figures that a government may prefer to keep quiet, and Rosstat has been a sensitive example. The Moscow Times notes that Rosstat stopped publishing annual cause-of-death statistics in 2024 and that other data useful for judging the war’s impact has left public access. The groups say their haul includes war-loss data, which fits that gap.
Our own reading is that the target also has practical appeal. A federal agency with regional offices runs many connected systems, a public website that anyone can see defaced, and census and demographic databases with personal records. That mix serves a group that wants publicity, pressure and material for journalists at the same time. Cyber Partisans’ longer write-up invites journalists to examine the material.
Brandefense Blackhole holds 36 Telegram posts dated 1 November 2026 that mention the attack, spread over 30 channels and written mostly in Russian. Almost all are news reposts. Two come from a chat named “Cyber Partisans”, one the group’s announcement and one a chat comment, and a copy of Silent Crow’s statement appears in a further chat. We treat all of it as claims, not evidence of impact.
What Can Defenders Take From a Claimed Wipe?
The steps below are our advice, not findings from the sources above. They address the pattern the groups describe: long quiet access, then destruction of directory and virtualization layers. A wiper attack is far less costly when recovery assets sit outside the domain.
- Protect the directoryTreat domain controllers and hypervisor management as the crown jewels: separate admin accounts, phishing-resistant sign-in, and alerts on new domain admins.
- Keep backups out of reachHold offline or immutable copies that the domain and the hypervisor cannot delete, and test a full restore.
- Watch for long quiet accessReview VPN, remote-access and tunnelling activity for patterns that persist for months, not days.
- Track bulk data movementAlert on large transfers out of file servers and databases; see our entry on data exfiltration.
- Plan the public responsePrepare a statement for the moment a group claims a breach before you have verified it.
A hacktivist release of DHS staff records raised similar claim-versus-confirmation questions. Read our DHS Icepick explainer for that case.
What Is Still Unknown?
Rosstat has not said how the attackers got in; it says its infrastructure worked normally, and specialists with law enforcement are establishing the attack vector. The groups have promised a detailed post with part of the data, which would be the first chance for outside review. We recommend that readers do not seek out leaked files, and we will not add details about individuals if any appear.