Rosstat Cyberattack: Russia's Statistics Agency Is Still Restoring Systems, What Is Confirmed and What Businesses Should Check

Russia's federal statistics agency, Rosstat, says it is still restoring its computer systems after cyberattacks that ran from October 29 to November 1, 2026, and it has warned that some statistics may be published late. It matters to businesses because one of the groups claiming the attack says it sat inside the network for about six months before wiping it, and that claim, true or not, is a fair test of whether your own backups and logs would survive the same thing.

What happened in the Rosstat cyberattack

Rosstat is formally the Federal State Statistics Service. The timeline below comes from its statements as carried by the Russian news agency Interfax. We tried to open the statements on rosstat.gov.ru directly and the site did not load from our connection, so Interfax is the closest record we could read.

• October 29 to November 1, 2026: Rosstat says "targeted destructive cyberattacks" hit its information resources.
• November 1: Rosstat said monitoring flagged the suspicious activity early, that it had found no compromise of databases or leak of legally protected information, and that its security units and law enforcement were working to establish the attack vector and the sources of the threat. The same day, the Cyber Partisans group published its own account claiming responsibility.
• Thursday, November 5: Rosstat said rosstat.gov.ru was running again, but that some website and IT functions may be temporarily unavailable, that some parts of its infrastructure remain isolated for checks, and that full restoration is continuing around the clock. It extended the deadline for submitting primary statistical data on a number of federal forms to November 13, 2026, and warned that some publications may be delayed.

Rosstat hack: what is confirmed and what is only claimed

Cyber Partisans published screenshots it says show a domain controller, a hypervisor and a storage deletion, plus a sample document marked for official use. It says a more detailed post showing part of the data will follow. Screenshots from the attackers are not independent proof. The Ukrainian casualty figures the group says it placed on Rosstat's website should also not be read as records from Rosstat's databases: the group itself describes them as Ukrainian statistics.

What is not known about the Rosstat breach

• How the attackers got in. The Cyber Partisans post says only that they got into the network.
• Whether any data left the agency, and how much. The two groups give very different totals, more than 10 TB and about 23 TB, and Rosstat says it found no leak.
• Who is really behind it. Two groups claim it. In the statements we read, Rosstat names no attacker or country.
• When recovery will finish. We found no completion date.

Why the Rosstat attack matters for a company network

Nothing we read shows this was a government operation. Cyber Partisans frames it as political opposition to the Russian government. A statistics agency in Russia is also a long way from an Ohio company. The reason to care is the method being claimed.

A long quiet period. If an intruder can spend six months on a network, short log retention means the evidence is gone before anyone looks for it. CISA's guide recommends keeping logs for critical systems for at least one year where possible.

Everything hit at once. The list of what was supposedly destroyed covers servers, storage, the virtualization layer and VPN. In our view, if your backups, hypervisors and admin accounts can all be reached from one network, one intruder can damage them together. If you run your own server infrastructure, start there.

The website is not the business. Rosstat's site is back, yet parts of its infrastructure stay isolated and reporting deadlines moved. The equivalent for a company is a homepage that loads while invoicing, scheduling or customer records do not.

Rosstat cyberattack checklist: what to do this week

There is no patch here, because no software flaw has been identified. These are readiness checks. The middle column is what CISA's StopRansomware Guide says. The right column is our own suggestion for testing it. The guide is written for ransomware, and Rosstat has not called this ransomware, but the same controls apply to an attacker who deletes instead of encrypting.

Rosstat cyberattack questions people are asking

What happened to Rosstat?

Rosstat says targeted destructive cyberattacks hit its information resources from October 29 to November 1, 2026. On November 5 it said its website was running again and that full restoration was still under way.

Was Rosstat data stolen?

That is disputed. Two hacking groups claim to have taken large volumes of data. Rosstat says it found no compromise of databases or leak of legally protected information. We found no independent verification either way.

Who hacked Rosstat?

Cyber Partisans and Silent Crow claim responsibility. Rosstat says the sources of the threat are still being identified, and it names no attacker in the statements we read.

Was the Rosstat attack a nation-state cyberattack?

Nothing we read establishes that. The groups claiming it present themselves as political opponents of the Russian government, and no attribution to any state appears in Rosstat's statements.

Is the Rosstat website working?

Rosstat said on November 5 that it had resumed operating, with some functions possibly unavailable while systems are brought back in stages.

Are Russian statistics delayed?

Rosstat warned that some publications may be delayed and said an updated schedule of urgent releases would appear in the Announcements section of its site. Anyone who relies on those figures should check it before planning around a release date.

Does this affect my business?

Probably not directly, unless you report to Rosstat or use its data. The practical value is as a rehearsal: could you recover if servers, storage and VPN all went at once?

The bigger lesson

The public part of an attack and the private part of recovery are rarely the same length. A website can return while the systems behind it take far longer to trust again. Decide now what must be true before you reconnect a system after an incident, and prove your backup works before you need it.

For help with backups, logging and admin access, see security hardening or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Interfax, carrying Rosstat's statements; Cyber Partisans; CISA StopRansomware Guide; eeNews Europe.