top of page

CYBERATTACK ON ROSSTAT—THE RUSSIAN FEDERAL STATISTICAL SERVICE

1 hour ago
3 min read

Cyberpartisans, together with their colleagues at Silent Crow destroyed the heart of Rosstat, where all key data on Putin’s regime's socio-economic indicators converged.



🔥 We wiped out Rosstat’s IT infrastructure: databases, servers, virtualisation environment, document management systems, workstations, personal workstations, and VPNs.


🔥 We destroyed key systems including STATECH, DCPC, Demography, EDMS, ESSBO, ONS, employee wiretapping, Stateregister, Digital Analytical Platform, and others.


🔥 We obtained valuable data (including state-secret-classified information). The total volume of document management systems and databases downloaded exceeds 10 TB.


🔥 We posted official Ukrainian data regarding Russian losses in Ukraine on the Rosstat website. 😏



Cyberattack on Rosstat — Details


Cyberpartisans, in collaboration with Silent Crow,  infiltrated the network of the Russian Federation's Federal State Statistics Service approximately six months ago. Since then, a methodical effort was launched to secure access to all of Rosstat’s core systems—a process carried out slowly and cautiously over the course of 4 months.


Rosstat Network Domain Controller
Rosstat Network Domain Controller

After gaining access to the agency’s critical systems, we systematically exfiltrated vital data and internal documents. Our reach extended to massive storage repositories holding more than 5 PiB of data (1PiB = 1024TiB).


Once we had firmly established our foothold in the network and gathered the most critical intelligence, we teamed up with our colleagues a month ago to plan the strike. The operation peaked in intensity over the past two weeks.


The cyberattack on Rosstat itself, which dismantled its entire critical IT infrastructure, began overnight between October 31 and November 1.


The most devastating phase of the attack targeted the agency’s internal network, destroying both virtual and physical servers alongside mass data storage systems. Recovery will demand a significant amount of time and resources from the Putin regime.


A message to all Rosstat employees who support the Russian regime!
A message to all Rosstat employees who support the Russian regime!

 The compromised “hypervisor” is a server running the “domestic” virtualisation software zVirt.
 The compromised “hypervisor” is a server running the “domestic” virtualisation software zVirt.

Deletion of Rosstat’s 1,800 TB mass storage.
Deletion of Rosstat’s 1,800 TB mass storage.

As a bonus, we also published official Ukrainian statistics on Russian war losses directly on the Rosstat website. The data managed to stay online for about an hour. Shortly after, everything within Rosstat’s internal network began crashing, taking the public website down with it 😊. While the site remains completely unavailable, you can still view the archived page at this link:




We should note that Rosstat’s defenses were significantly more robust than those of Aeroflot, which we targeted in 2025. They had even made a concerted effort to defend themselves specifically against us. As an example, here is one of the internal documents we uncovered on their network.


Measures to prevent information security threats associated with the activities of the GOFFEE and Cyber Partisans hacker groups. :)
Measures to prevent information security threats associated with the activities of the GOFFEE and Cyber Partisans hacker groups. :)

Nevertheless, the measures taken did not save them.. :)


What data was obtained


The vast array of information extracted from Rosstat’s internal network consists of socioeconomic and demographic indicators.


Among them are classified statistics on actual mortality in the Russian Federation, including causes of death (a total of over 1 TB of data). In addition, there are classified statistics on the occupied Ukrainian territories.


We also downloaded the document management system (over 3 TB of documents, including those classified as “DSP” - For Official Use Only).


An example of a document or official use only from Rosstat’s document management system.
An example of a document or official use only from Rosstat’s document management system.

The total volume of documents and databases we’ve obtained exceeds 10 TB.


We’ll soon publish a detailed post showcasing some of the data we’ve obtained. Independent journalists and investigators will be able to assess what kind of information they can request from us.


Stay tuned for updates!


 
 
  • Telegram-icon-on-transparent-background-PNG_edited
  • Twitter
  • Youtube

© 2026 by CyberPartisans

bottom of page