By rosstat committed: 23TB of data Russian military, stolen, information about victims of war exposed
The 29 October to 1 November 2026, the statistical agency of the Russian state, by rosstat, was hacked.
It was not a theft of trade. It was not theft of data of citizens.
It was a theft of military information state.
23 terabytes of data were exfiltrados. Including information on victims of war. Casualty figures. Military operations are sensitive.
This is not an incident of private security. Is a violation of national security.
The severity of the issue
What is by rosstat
By rosstat is the Federal Service of Statistics of Russia. It is the official agency of the state to collect and maintain national data.
Includes:
- Demographic data
- Economic data
- Military data
- Data infrastructure
- Data of national security
What was stolen
FACT (according to SC World):
Between 29 October and 1 November 2026, 23 terabytes of data were exfiltrados of by rosstat.
Includes:
- System of management of internal documents (containing classified data)
- Information on victims of the war Russia-Ukraine (casualty figures)
- Military data sensitive
- Information national infrastructure
Who stole it
FACT: The attacks were claimed by:
- Belarusian CyberPartisans (group cyberactivist pro-Ukraine)
- Silent Crow (group of hackers with alignment pro-Ukraine)
Why is critical
ANALYSIS: This is not simply a ‘data breach’. Is:
- Espionage of state against state: classified Information to Russia in the hands of actors pro-Ukraine
- Information war exposed: Casualty figures can be used as propaganda
- Operational intelligence committed: Information about infrastructure and military operations
- Escalation of conflict: war In context Russia-Ukraine, this is an act of cyber war
Why it was possible to
Vulnerability state
SPECULATION CONTROLLED: For actors cyber achieve the exfiltration of 23TB of data:
- Probably known vulnerabilities without patching
- Or inadequate security for classified data
- Or credentials of employees engaged
- Or third-party access is not monitored
Lack of correlation
If by rosstat had detection systems suitable:
- 23TB of data being exfiltrados should generate alerts massive
- Movement of data to external locations should be detected
- Access anomalous to classified systems should be blocked
The fact that it happened without (apparently) to be detected in real-time suggests a lack of monitoring.
The impact
National security
Information Russia’s military is now in the hands of actors pro-Ukraine. Includes:
- Deployment strategy
- Figures of real losses (vs propaganda)
- Information of vulnerable infrastructure
- Potentially operational plans
Propaganda and information warfare
The stolen data can be used to:
- Demonstrate loss figures Russian (information warfare)
- Expose military operations
- Undermine the credibility of official statements of Russian
Precedent of cyber war
This attack demonstrates that:
- Government agencies in countries in conflict are targets
- Classified data can be stolen to scale
- There is No effective defense against attacks co-ordinated state/actors
How to 24Cevent would have caught this
If by rosstat had detection of abnormalities at the level of state agency:
Detection of initial access
When the attackers fall (Oct 29):
- Access anomalous to classified systems
- Credentials from unknown location
- Pattern of lateral movement detected
24Cevent: CRITICAL INCIDENT + escalation FSB/GRU
Detection of exfiltration massive
When 23TB are being drained:
- Massive volume of data coming out of classified systems
- To remote location (darknet/VPN)
- Correlation: initial Access + exfiltration = COORDINATED ATTACK
24Cevent: IMMEDIATE LOCKOUT + insulation + network notification to national security
Detection of the pattern of espionage
If systems were correlated:
- Access to classified data
- Access to casualty information
- Access to military infrastructure data
- All at the same time
24Cevent: ‘ESPIONAGE DETECTED’ + response at the national level
The lesson
This incident exposes an uncomfortable truth:
The state agencies do not have defenses measures against attacks of actors sponsored.
Russia, with all its resources, was unable to:
- Prevent access
- To detect the exfiltration in real time
- To block the exit of 23TB of data
If by rosstat could not defend themselves, and what institution you can?
The answer is: Only those that have automated detection of anomalies at the state level + coordinated response.
SOURCES CHECKED: