U.S.-China Relations
NextFin News - Russia's federal statistics agency, Rosstat, has delayed major economic reports through at least November 13 after a coordinated cyberattack that knocked its systems offline and left investors and policymakers without a reliable read on the Russian economy. The agency confirmed it was targeted between October 29 and November 1, but two hacktivist groups claim to have stolen up to 23 terabytes of data, including records on Russian military casualties in Ukraine.
The disruption is the latest blow to the transparency of Russian official data, and it lands at a moment when independent verification of Moscow's wartime economy is already scarce. The immediate outage is a cyclical problem that technicians can restore. The deeper story is structural: every successful strike against a data institution pushes Russia's economic statistics further into an opaque, politically controlled information space, and forces the market to price the country on guesswork.
The Situation: Delayed Reports and Competing Claims
Major Russian economic reports will not be published on schedule through at least November 13, according to the agency's revised timetable. The delay follows a weekend in which Rosstat failed to publish two scheduled weekly price releases on Friday, postponing them repeatedly before finally issuing the data. Some previously published information has also disappeared from the Rosstat website, and Russian companies reported being unable to submit mandatory reports for several days after the agency promised on November 1 to restore access in the near future.
Rosstat describes the incident as a series of "carefully prepared" attacks coordinated across multiple areas of its information systems. In a statement carried by Russian state media, the agency said its monitoring systems detected suspicious activity early enough to initiate a response, and that it is working with cybersecurity experts and law enforcement to identify the source. Rosstat denies that its databases or legally protected information were compromised, and told one Russian newspaper that its infrastructure was working normally.
The hackers tell a different story. The Belarusian Cyber Partisans and the pro-Ukrainian Silent Crow movement said on November 1 that they spent roughly six months inside Rosstat's network, quietly collecting internal documents and expanding their access, before launching a destructive operation that culminated overnight on Saturday. Silent Crow claimed control of approximately 25,000 computers and devices across Rosstat's headquarters, regional offices, and main statistical data processing center, and put the total exfiltrated data at about 23 terabytes, including roughly 2 terabytes from a restricted-access document perimeter. The Cyber Partisans separately put the stolen volume at more than 10 terabytes.
The groups said the haul includes demographic and economic statistics, population census materials, internal government correspondence, confidential mortality records detailing causes of death in Russia, and nonpublic statistics from Russian-occupied Ukrainian territories. As evidence, they published screenshots showing what they described as a domain controller on Rosstat's internal network, a deletion command on a Russian-made Tatlin storage system, and a server console returning disk write errors with the message "ROSSTAT KAPUT."
None of the destruction or theft claims has been independently verified. Independent reporting assessed on November 1 that the claims could not be confirmed, and security researchers note that Rosstat's denial is its own statement rather than an independent audit. What is confirmed is narrower but consequential: the websites were defaced with both groups' logos and a warning in Belarusian that read, "No one will escape accountability," and the agency's publication schedule has been materially disrupted.
Claimed vs. Confirmed: A Familiar Pattern
This is not the first time the two groups have joined forces against a major Russian organization, and their record mixes confirmed damage with unverified claims. In July 2025, the Cyber Partisans and Silent Crow claimed responsibility for a disruptive attack on Aeroflot, Russia's flagship airline, which forced the carrier to cancel more than 100 flights and affected roughly 20,000 passengers. Silent Crow said 7,000 servers were destroyed; a flight-tracking service counted 108 cancelled flights on July 28. Russian prosecutors confirmed an attack and opened a criminal case.
In January 2025, Silent Crow claimed to have stolen a database containing 2 billion records on property owners from Rosreestr, the state real estate registry. The agency denied a leak, but journalists were able to verify some of the information the hackers published. In November 2022, the Cyber Partisans claimed to have wiped a domain controller at a sub-agency of Roskomnadzor, Russia's media regulator; the agency confirmed a breach.
The pattern teaches a simple discipline: claims of destruction and theft from these groups require checking, but the access behind them has sometimes been real. Russia's Supreme Court designated both groups as extremist organizations in July 2026, effectively outlawing their activities inside the country, though the practical consequences remain unclear as the hackers have continued targeting Russian organizations.
Rosstat's own account concedes more than a routine outage. The agency told one Russian outlet that the attacks were carefully prepared, multi-directional, and staffed by many specialists. The Cyber Partisans said Rosstat proved a harder target than the airline.
"Unlike Aeroflot, which we attacked in 2025, Rosstat had a more robust security system. We reached the agency's critical systems while systematically extracting sensitive data and internal documents."
Why a Statistics Agency Is a Strategic Target
On its face, a statistics office seems an odd prize for hackers seeking impact. But Rosstat sits at the center of how Russia's economy is measured and how the outside world judges the cost of the war. The agency collects and publishes official statistics on Russia's population, economy, and social conditions, and holds extensive government data including demographic records and information from Russian-occupied Ukrainian territories. Its data feeds the Ministry of Economic Development, the Central Bank of Russia, the Eurasian Economic Commission, and the Statistical Committee of the Commonwealth of Independent States.
The timing matters. Rosstat stopped publishing its annual cause-of-death statistics in 2024, and other data useful for assessing the war's impact has quietly disappeared from public access. The groups say their haul includes war-loss data, which fits that gap. Silent Crow framed the operation as a reckoning with the agency's own opacity.
"It looks like Rosstat will have to recalculate not only its statistics this time, but also the scale of its own problems."
The credibility of Russian economic statistics has been under pressure for years. An analysis by the OSW Centre for Eastern Studies, a Warsaw-based policy institute, noted that since 2017 Rosstat has reported directly to the Ministry of Economic Development, which is responsible for implementing Russia's economic policy and achieving the country's macroeconomic goals. The government tightened its grip by placing the ministry's representatives in charge of the statistical service twice in succession. Rosstat, the analysis argued, has been accused of succumbing to pressure from the Kremlin and effectively becoming involved in government propaganda, and its frequent methodology changes have drawn repeated objections.
The war has accelerated that drift. As sanctions tightened and Moscow shifted resources toward the military-industrial complex, official output grew harder to reconcile with high-frequency proxies. Electricity consumption, rail freight volumes, import records from trading partners, and satellite imagery have become the parallel ledger that outsiders use to cross-check official Russian figures. An attack that interrupts even the official ledger accelerates that shift: when the primary source goes dark, the market does not stop pricing risk, it simply prices it on thinner, noisier inputs.
Cyclical Outage, Structural Drift
The right way to read this event is to separate two layers that are often blended. The outage itself is cyclical: servers can be rebuilt, backups restored, and publication schedules caught up. Rosstat has already resumed issuing some delayed releases, and a November 13 resumption window implies a disruption measured in days, not quarters. On that timescale, the episode is an operational incident, not a regime change.
The structural layer is different, and it points the other way. Each successful intrusion into a Russian data institution — Rosreestr, Aeroflot, Roskomnadzor, now Rosstat — raises the cost of maintaining trustworthy official statistics in three ways. First, it forces the agency to divert resources from data collection to forensic recovery and hardened infrastructure. Second, it gives Moscow a standing incentive to withhold data preemptively, on security grounds, shrinking the public record. Third, it erodes the credibility of whatever is eventually published, because the line between a cyber-induced gap and a politically motivated one becomes impossible to draw from the outside.
That is the asymmetry hacktivists are exploiting: they do not need to prove that 23 terabytes left the building. They need the outside world to doubt that the data inside it is complete. A statistics agency runs on trust, and trust is cheaper to damage than to rebuild.
The second-order effect runs through the market for Russian risk. Russian equities and bonds already trade in constrained, sanction-fractured markets with limited foreign participation, so there is no clean price signal that pins the damage to a specific move. But the users of Rosstat data are not only traders. The Central Bank of Russia sets policy on inflation and growth prints; the Finance Ministry builds its budget on GDP and revenue forecasts; foreign counterparties in Asia and the Middle East size their exposure to Russia on official macro data. When the source of those numbers goes offline for a reporting cycle, the error bars around every downstream decision widen. That is a real cost even if no index ticks on the day.
The transmission chain is longer than a headline suggests. The attack does not merely delay a release; it forces every consumer of Russian data to widen its confidence intervals. A central bank that cannot read current inflation prints must decide policy on lagged information. A trading partner negotiating commodity volumes must price in the risk that its counterpart's own numbers are stale. An investor modeling Russian earnings must substitute proxies for reported figures. Each substitution adds noise, and noise is priced as risk premium. The premium is invisible in any single asset, which is precisely why the damage is easy to understate.
The Counter-Thesis: Why This May Be Contained
The strongest case against the structural reading is straightforward: Russia's official statistics have survived worse than a week-long outage, and the state has shown a consistent willingness to publish whatever serves its narrative. From this angle, the hack is an irritant, not an inflection point. Rosstat's data pipeline is redundant; regional offices and the main processing center can be rebuilt from backups. The agency has already resumed issuing delayed releases, and the November 13 deadline suggests business as usual within days.
There is also the question of what the hackers actually proved. The theft and destruction claims rest on screenshots and Telegram posts, not on a verified data dump. Russia's Supreme Court designation of the groups as extremist has not stopped their operations, but it has limited their ability to operate openly or to build the kind of sustained institutional access that produces auditable evidence. Until samples appear, the default assumption should be that the agency's own account — attack confirmed, databases intact — is at least as credible as the claimants'.
That case has force, but it rests on a premise the past four years have eroded. Russia has not merely suffered isolated cyber incidents; it has progressively withdrawn the very data that would let outsiders distinguish an incident from a cover-up. Cause-of-death statistics stopped appearing in 2024. War-impact data has left public access. Methodology changes have multiplied. Against that backdrop, the burden of proof has shifted: the agency that withholds must explain what is missing, not merely assert that nothing was lost.
What to Watch Next
Three signals will determine whether this remains a contained outage or becomes a lasting data gap. First, whether Rosstat meets its own November 13 deadline for resuming major reports, and whether the backlog of weekly price releases clears without further postponement. Second, whether the hackers publish the samples of data they have promised in the coming days, which would give outside researchers the first chance to verify the theft claims. Third, whether the missing previously published information returns to the Rosstat website, or whether those gaps become permanent.
Base case: restoration proceeds on schedule, the promised data samples prove limited, and Rosstat's denial holds — the market impact stays confined to a few delayed releases. Upside case for the hackers: a verified dump of internal documents, especially mortality or military-casualty records, would turn an operational incident into a transparency crisis with political consequences inside Russia. Downside case: restoration slips past mid-November, additional agencies report similar intrusions, and the blackout spreads to monthly GDP, inflation, or trade releases — at which point the cyclical call flips structural.
The falsifying signal for the view that this is contained is specific: if Rosstat fails to publish its scheduled monthly economic releases on time after November 13, or if an independent audit confirms that protected databases were exfiltrated, the incident should be reclassified as a structural degradation of Russia's statistical capacity rather than a recoverable outage.
Short term, expect noise: delayed prints, revised timetables, and heightened scrutiny of anything Rosstat does release. Medium term, the burden shifts to alternative data providers and to the agencies that consume Rosstat's output. Long term, the question is whether Russia's official statistics can ever regain the trust of outside observers once the boundary between cyber damage and political opacity has been blurred. The hackers' warning was aimed at accountability. The market's takeaway is narrower and more practical: for as long as the data stays unreliable, Russian assets carry an unpriced information premium.
The real casualty of the Rosstat attack may not be the servers. It is the assumption that an official number, once published, can be trusted.
Explore more exclusive insights at nextfin.ai.
