Belarusian Cyberpartisans and Silent Crow said in early November 2026 that they stole data from Rosstat, Russia's federal statistics service, including an internal Demography extract of death certificates. The catalog entry records an unverified data-theft claim. Rosstat confirmed cyberattacks between 29 October and 1 November 2026 and denies that its databases were compromised or that information leaked. Actor counts of 393,881 to 450,100 war-related deaths are their analysis of a file they say they hold. Those counts are not a confirmed unique-people census for this catalog. recordsAffected stays 0. This page does not link dumps.
The groups say they had access for about six months before hitting infrastructure overnight on 31 October to 1 November, and that they took on the order of 23 terabytes. Journalists covering the claim say they have not independently authenticated the full dataset. Treat the attack window as something the agency has acknowledged, and the leak as a claim the agency rejects.
What is being claimed about the Rosstat breach?
Two aligned groups describe a statistics-agency intrusion, not a battlefield hack of the defence ministry. Death certificates, if real, are civil-registry extracts with causes of death, ages and other fields. Silent Crow's higher figure adds non-combat military deaths and some records with no stated cause. Cyberpartisans' lower figure sticks closer to combat-coded deaths. Neither figure is a catalog census.
Independent outlets have been counting identified Russian military deaths from open sources for years. Those projects are not this leak. Do not merge Mediazona or BBC Russian tallies into this row. Do not use the actor numbers as "records affected." A death-certificate extract, even if genuine, is a file of events, not a notification list of account holders.
Euronews and others also note missing persons, delayed registrations and foreign fighters who never enter Russian civil records. Even a genuine extract would undercount some deaths and might include civilians coded under operations of war. That is a research caveat, not a reason to treat the file as confirmed. This catalog's job is the privacy event: an agency attack that is acknowledged, and a theft that is still a claim.
Rosstat's denial matters for the confirmed flag. The agency says attacks happened and databases did not leave. Until that gap closes with a later official correction or a solid independent match, the catalog stays on unverified for the theft.
What data is alleged?
Claimed: Demography death certificates from February 2022 through August 2026, plus other economic and demographic holdings in a large archive. Cause-of-death codes and military markers are what the groups say they counted. Names of the dead, if present in the extract, would be personal data. This catalog will not reproduce lists of names. No dump links.
Who would be affected if the leak were real?
Families of people whose deaths were registered in the claimed window, and anyone else whose personal data sat in the alleged 23 TB. That is a hypothetical until the file is matched. Rosstat staff are not automatically a notified set. Ukrainian and Western readers looking for a confirmed casualty API will not find one here.
Moscow has not published a comparable official battlefield total since 2022. That political gap is why a claimed statistics-agency extract draws coverage. It is also why this page stays conservative. A privacy catalog that treated actor arithmetic as a confirmed census would be doing the groups' work for them.
What should I do?
- Do not download alleged Rosstat archives from random channels. That is how malware rides a news cycle.
- Do not treat 450,100 as a people-count in a privacy notice. It is an actor statistic.
- If you handle Russian civil-registry data in research, wait for a second source before citing the extract as official.
- Phishing will impersonate Rosstat or "casualty verification" desks. Do not send identity documents to those addresses.
- Keep the agency's attack-window acknowledgement and its denial together. If Rosstat later confirms a leak, the catalog should move off unverified.
The Binance claim post is the other large unverified advertisement this week. The York University post is the contrast: a university that confirmed theft from its own forms.
Frequently asked questions
Did Rosstat confirm a data leak?
No. It confirmed cyberattacks from 29 October to 1 November 2026 and denies that databases were compromised or information leaked.
Is 450,000 the number of records stolen?
No. That is an actor count of war-related deaths they say they derived from death certificates. recordsAffected stays 0.
Who claimed the hack?
Belarusian Cyberpartisans and Silent Crow, in public posts covered by Kyiv Independent, Euronews and others. Attribution is theirs.
Has the dataset been authenticated?
Journalists say they have not independently verified the full extract. Some researchers have discussed samples. That is not a catalog confirmation.
Will this page link the dump?
No. BreachHistory does not link dumps.
Sourcing note: the 29 October to 1 November attack window and Rosstat's denial of a database leak come from contemporaneous coverage of the agency's statement. The 393,881 and 450,100 figures and the 23 TB claim come from the groups' own public analysis as reported by Kyiv Independent and Euronews. No dump URLs are included.