In This Article
Russia may have lost between 394,000 and 450,000 people in its war against Ukraine, according to confidential death records that two hacker groups say they took from the country’s own statistics agency, a toll far higher than any figure Moscow has ever acknowledged. The groups, the Belarusian Cyber Partisans and the pro-Ukrainian operation known as Silent Crow, say they extracted the figures from the internal Demography database of Rosstat, Russia’s Federal State Statistics Service, which holds information from more than 11 million death certificates registered between February 2022, when the full-scale invasion began, and August 2026. They published their findings on November 7 and shared the data with Bloomberg News and a small group of other news organisations, and a Bloomberg investigation published on November 8 examined the material in detail. The two groups reached different totals because they used different methods, and neither figure has been independently verified, so every number in this story comes with a warning attached. Yet the leak has already become one of the most closely studied pieces of evidence about the human cost of a war whose true death toll has been hidden behind official silence for more than four years, and it arrives on the eve of the first direct trilateral ceasefire talks in months. This is the story of what the leaked records are said to show, how they were obtained, what checks have been run on them, and what is still unknown — the leaked Russian records war deaths Ukraine 450,000.
1. What the Leaked Records Show
The core claim is stark. Between February 24, 2022, when Russia launched its full-scale invasion of Ukraine, and late August 2026, the records are said to show somewhere between about 394,000 and 450,000 war-related deaths among people fighting on Russia’s side or otherwise linked to the war. The lower figure comes from the Belarusian Cyber Partisans, who counted at least 393,881 deaths in records that explicitly attributed the fatality to military operations. The higher figure comes from Silent Crow, which put the total at as many as 450,100 by using a broader method that also swept in non-combat deaths among military personnel and cases where the cause of death was not specified. Bloomberg News, which was given access to the data, carried out its own count and arrived at about 392,700 deaths directly tied to the war through cause-of-death codes or through language in the records referring to military operations, airstrikes or drone attacks, a figure that sits close to the Cyber Partisans’ total and suggests the two counts are measuring broadly the same thing. The range matters because it is not a single number but a band, and the band exists because the people who published the figures made different choices about what to count. What they agree on is the order of magnitude: by either method, the toll is in the hundreds of thousands, far above the 285,881 Russian military personnel that the independent outlet Mediazona and BBC Russian had identified by name as of November 6, and far above anything the Russian government has ever said in public.
1.1 The Two Counts: 393,881 and 450,100
The difference between the two published totals comes down to method, and understanding the method is the key to understanding the argument. The Cyber Partisans took the narrower path, counting only the records that explicitly identified military operations as the cause of death, using the international classification code Y36, which covers deaths from war operations, and records whose wording referred to combat or to the long-term effects of fighting. Their total, at least 393,881, is presented as a floor rather than a final figure, because it leaves out every death that was not labelled in that way. Silent Crow cast a wider net. Its breakdown, reported by Radio Free Europe/Radio Liberty and the Ukrainian outlet Glavcom, includes 356,056 certificates coded Y36, a further 38,229 coded Y89.1 or worded as combat deaths, and 18,291 combat deaths recorded with no code at all, along with 14,160 military personnel killed outside combat and deaths where no cause was given but the person died in Ukraine or in occupied territory. The wider count also includes killed civilians, which the narrower count does not. The gap between 393,881 and 450,100, roughly 56,000 people, is therefore not a disagreement about the underlying database but a disagreement about where the line should be drawn around a war death, and it is a disagreement that runs through every attempt to count the dead in this conflict, from open-source name lists to official estimates.
1.2 A Database of More Than 11 Million Death Certificates
The dataset at the centre of the story is vast. It is said to contain more than 11 million death certificates, each carrying details including the deceased person’s age, place of residence and location of death, drawn from the internal Demography database of Rosstat, the agency that records births, deaths and marriages across Russia. The records cover deaths registered between February 2022 and August 2026, and it is the sheer scale of the database that gives the leak its weight: it is not a sample, a survey or an estimate built from fragmentary reports, but, if genuine, a near-complete register of who died in Russia during the war years, with the cause of death recorded certificate by certificate. That scale also explains why the two groups reached slightly different totals from what they say is the same material, because a database of 11 million records contains millions of ambiguous cases, and the choices made in sorting them move the final figure by tens of thousands. The database’s size is also what made it possible for Bloomberg to test it against Rosstat’s own published statistics, a check that is described in detail below. For now, the important point is the nature of the material: it is said to be Russia’s own record of its own dead, compiled by its own statisticians, and it is that origin, rather than any claim by the hackers themselves, that has made the leak so difficult for Moscow to dismiss outright.
2. Who Obtained the Data and How
The two groups behind the leak are very different organisations that came together for this operation. The Cyber Partisans are a Belarusian hacktivist collective that emerged in 2020 in opposition to the government of Alexander Lukashenko, and they have spent years targeting the systems of the Belarusian and Russian states. Silent Crow is a pro-Ukrainian hacking operation that has claimed a series of attacks on Russian targets since the full-scale invasion began. The two groups said they published their findings on November 7, after sharing the data with Bloomberg News and a small group of other media organisations, and they have since spoken to reporters about how the operation unfolded. Neither group has published the full database, and neither has released a verified sample that independent researchers could examine in full, which is one of the reasons the figures remain unverified. What they have said about the operation itself is detailed enough to be checked against the public record, and the parts that can be checked, such as the dates of the cyberattacks on Rosstat’s systems, line up with what the agency itself has acknowledged.
2.1 Cyber Partisans and Silent Crow
The Cyber Partisans describe themselves as anonymous hacktivists opposed to the regime in Minsk, and they have a record of operations against state systems in Belarus, including the theft and publication of police and government databases. Their involvement in the Rosstat operation fits a pattern of targeting the administrative machinery of the Russian state and its allies rather than purely military systems. Silent Crow, by contrast, is a pro-Ukrainian operation that has presented itself as part of the wider campaign of cyberattacks against Russian state infrastructure since 2022. The two groups say they worked together on the Rosstat operation, and they have given different accounts of how much data they took: the Cyber Partisans say more than 10 terabytes, while Silent Crow puts the figure at about 23 terabytes, a discrepancy that has not been explained and that underlines how much of this story rests on the groups’ own statements. What is not in dispute is that both groups have claimed responsibility for the attack, that they published their findings on the same day, and that the figures they published, while different in total, are built from the same claimed source. The Kyiv Independent, one of the outlets that covered the leak, said it could not immediately verify the leaked records or the casualty estimates, and no third party has yet published a forensic confirmation of the material.
2.2 Six Months Inside the Network
According to the groups, the operation was not a single break-in but a long campaign. They say they gained access to Rosstat’s network approximately six months before launching the attack, spending that time systematically collecting internal documents and other data before targeting the agency’s IT infrastructure overnight on October 31 to November 1. The attack itself was claimed on November 1, when the two groups announced they had wiped Rosstat’s servers, and the timing matters because Rosstat has itself acknowledged that its systems faced targeted cyberattacks between October 29 and November 1, a window that matches the hackers’ account. The claim of a six-month presence inside the network, if true, would explain how the groups were able to extract a database of more than 11 million records, a task that would take time and careful planning rather than a single night’s work. It would also explain why the data they published covers deaths registered up to late August 2026, a cutoff that suggests the extraction happened before the final attack, while the groups still had quiet access. None of this has been independently confirmed, and the groups have not released the technical evidence that would let outside experts verify how they got in. But the outline of their account is consistent with the public timeline, and it is the outline that news organisations have been able to check.
3. What Bloomberg’s Checks Found
Bloomberg News was given access to the data before publication, and its investigation, published on November 8, is the most detailed examination of the material so far. The news organisation said it was not possible to independently and cryptographically prove the authenticity of the database, a candid admission that sets the limit on what anyone can claim about the leak. What Bloomberg said it could do was test the data against what is already known, and the tests it ran came back in the database’s favour. Its review found that the metadata was consistent with a genuine data export and found no indicators of fabrication, and its checks found only a 0.1 percent difference between total death figures in the leaked database and Rosstat’s official figures for 2021, and a 0.2 percent difference for 2022. Those are small discrepancies for a dataset of 11 million records, and they are the strongest evidence yet offered that the material is what its publishers say it is. The investigation also produced its own count of about 392,700 war-related deaths, close to the Cyber Partisans’ figure, which gives the story a second, independently produced number to set beside the hackers’ claims.
3.1 The Metadata Test
The metadata check is the part of Bloomberg’s work that has drawn the most attention, because it is the kind of test that can catch a forgery. Metadata is the information embedded in a file about how it was created, when it was exported and what system it came from, and a fabricated database would be expected to show inconsistencies in that information. Bloomberg said its review found the metadata consistent with a genuine export from Rosstat’s systems, and that it found no indicators that the data had been fabricated. The second check was a comparison with the agency’s own published totals: the leaked database’s overall death figures for 2021 and 2022 matched Rosstat’s official figures to within 0.1 and 0.2 percent, a closeness that would be difficult to achieve by inventing 11 million records from scratch. Neither test proves the database is genuine, and Bloomberg was careful to say so, but together they make the material harder to dismiss as a fabrication. The checks are also the reason the story has been treated seriously by other news organisations, even while they note that the figures have not been independently verified.
3.2 The Limits of Verification
For all the weight of those checks, the limits on verification are real and have been stated plainly by everyone involved. Bloomberg said it could not cryptographically prove the authenticity of the database, which means there is no digital signature or other technical proof that would settle the question beyond doubt. The Kyiv Independent said it could not immediately verify the leaked records or the casualty estimates, and other outlets that covered the story, including Radio Free Europe/Radio Liberty and bne IntelliNews, relayed the figures with the same caution. No third party has published a verified sample of the database or a forensic confirmation, and the groups have not released the full dataset for independent examination, so outside researchers cannot repeat the counts or test the methods for themselves. The figures also rest on the hackers’ own statements about what they took and how they counted it, and the two groups disagree on how much data they extracted, with estimates of more than 10 terabytes and about 23 terabytes. Every number in this story should therefore be read as a claim about a leak, not as an established fact, and the post that follows from it should be read in the same way, as an account of what has been reported and what has been checked, rather than as a settled toll.
4. Rosstat’s Response
Rosstat, the agency at the centre of the story, has responded in two parts, and the two parts point in different directions. The agency acknowledged that its systems faced targeted cyberattacks between October 29 and November 1, a statement that confirms the timing the hackers gave for their operation. At the same time, it denied that its databases had been compromised or that information had been leaked, a denial that, if the leak is genuine, is difficult to square with the publication of figures drawn from its own records. The agency has not addressed the substance of the casualty figures, has not said whether it has examined the published data, and has not offered an alternative explanation for how the hackers could have obtained death-certificate data that matches its own published totals so closely. The Russian government, for its part, has not officially disclosed its military casualty figures since September 2022, and it has dismissed independent estimates of war losses as unreliable, a position that leaves the leak as the only source of information that claims to come from inside the state’s own records.
4.1 The Attack Acknowledged, the Leak Denied
The acknowledgement of the cyberattacks is the one point on which the agency and the hackers agree, and it is a significant one. Rosstat confirmed that its systems were targeted between October 29 and November 1, the same window in which the two groups say they launched their destructive operation and wiped the agency’s servers. The denial that followed, that no databases were compromised and no protected information leaked, is harder to assess, because it is a statement about what happened inside the agency’s systems, and the agency has not published the evidence that would support it. The hackers’ response has been to point to the data itself, arguing that the figures they published could only have come from Rosstat’s systems, and that the close match with the agency’s own published totals for 2021 and 2022 is itself evidence of the leak. The standoff is a familiar one in stories about stolen data: the victim denies the theft, the thieves publish the material, and the public is left to judge the evidence for itself. In this case, the evidence that can be checked, the dates and the statistical match, favours the hackers’ account, while the evidence that would settle the matter, a forensic examination of Rosstat’s systems, has not been made public.
4.2 Moscow’s Silence on Casualties
The leak lands in a vacuum created by the Russian government’s own refusal to publish casualty figures. Russia has never publicly disclosed its military casualty figures from the war in full, and it has not issued an official toll since September 2022, leaving the public record without a number that the state itself stands behind. The government has dismissed independent estimates of war losses as unreliable, and it has prosecuted or silenced journalists and researchers who have tried to count the dead, which has made open-source work such as Mediazona’s name-by-name count the main alternative to official silence. That silence is the context in which the leaked figures have to be understood, because it is the reason a hack of a statistics agency can become a major news story: in the absence of an official number, any figure that claims to come from inside the system carries weight, even when it cannot be verified. The silence also explains why the leak is likely to be debated for months, because it offers the first glimpse of a toll that the state has kept hidden, and because the state has so far offered no competing figure of its own. Until Moscow publishes its own numbers, the leaked records will remain the most detailed account available of how many Russians have died in the war, and the most contested.
5. How the Toll Compares With Other Counts
The leaked figures do not stand alone. They sit alongside a series of other attempts to count the dead, and the comparison between them is instructive, because it shows how much depends on method and on what is counted. The best known independent count is the work of the Russian outlet Mediazona, working with BBC Russian and volunteers, which identifies Russian military personnel killed in Ukraine by name, using obituaries, social media posts, cemetery records and official notices. As of November 6, that count stood at 285,881, a figure that is itself a record of extraordinary scale, built one name at a time over more than four years. The leaked figures are higher, by between about 108,000 and 164,000, and the gap is not a contradiction but a measure of what a name-by-name count cannot capture: soldiers whose deaths were never announced, whose families never posted an obituary, whose bodies were never identified, and whose names never appeared in any public record. The two counts are therefore best read together, as a floor and a range, rather than as rivals, with the named count setting the minimum that can be proven and the leaked records suggesting how far above that minimum the true toll may lie.
5.1 Mediazona’s Named Count of 285,881
Mediazona’s count is a different kind of evidence from the leaked database, and its strength is its transparency. Every person on its list is named, with a source for the death, and the count grows as new obituaries and records appear, which means it is always behind the true toll but always verifiable in a way that a leaked database is not. The figure of 285,881, as of November 6, 2026, is the product of years of painstaking work by journalists and volunteers, and it has become the standard reference point for the scale of Russian losses, cited by governments, researchers and news organisations around the world. Its authors have always said it is an undercount, because it can only include the deaths that leave a public trace, and because many Russian soldiers die in circumstances where no trace is left. The leaked figures, if genuine, would confirm that undercount and give it a scale: the difference between 285,881 named dead and 393,881 or 450,100 deaths in the leaked records is the measure of how many soldiers died without a public record. The two counts also agree on the shape of the war, with both showing a toll that has grown steadily rather than in sudden jumps, and both showing 2026 as a year of continued heavy losses.
5.2 Why the Numbers Differ
The differences between the counts come from three sources, and each of them matters. The first is coverage: a name-by-name count can only include the deaths it can find, while a database drawn from death certificates can include deaths that were never announced, which is why the leaked figures are higher. The second is definition: the Cyber Partisans counted only deaths explicitly attributed to military operations, while Silent Crow added non-combat military deaths, deaths with no specified cause and killed civilians, which is why their totals differ by about 56,000. The third is timing: death certificates take time to reach the database, and the median lag between a death and its formal registration stood at roughly six weeks in late 2023 and had stretched past four months by 2025, which means the most recent figures in the leak are the least complete. All three factors push in the same direction, towards undercounting rather than overcounting, and that is why the analysts who have studied the leak describe the figures as a floor rather than a ceiling. The true toll, on this reading, is at least as high as the leaked records suggest, and probably higher, once the missing, the unidentified and the unregistered are added in.
6. What the Records Say About the Human Cost
Beyond the headline totals, the leaked records are said to contain a picture of the war’s human cost that goes further than any previous estimate. One report on the leak said that war deaths had become the fourth most common cause of death in Russia since 2022, a statistic that, if accurate, would place the war alongside heart disease, cancer and other long-standing causes of mortality in a country of more than 140 million people. The comparison is a stark one, because it turns an abstract number into a measure of how deeply the war has reached into Russian society, touching families in every region and every age group. The records are also said to show the toll falling heavily on young men, the group that makes up the bulk of the fighting force, and on the regions that have supplied the most recruits, although the detailed breakdowns by age and place have not yet been published in full. What has been published is enough to show that the war’s cost is not confined to the battlefield, and that its effects will be felt in Russian demographics for a generation.
6.1 A Fourth-Leading Cause of Death
The claim that war deaths are now the fourth most common cause of death in Russia since 2022 is one of the most striking details to emerge from the leak, and it deserves to be treated with the same caution as the headline totals. It comes from the same dataset and the same counting methods, and it has not been independently verified, but it is consistent with the scale of the figures: a toll of 400,000 or more deaths over four and a half years would inevitably rank among the leading causes of death in a country where the annual death toll from all causes is normally around two million. The comparison also helps to explain why the leak has resonated so widely, because it translates a military statistic into a public health one, and because it suggests that the war has become one of the defining facts of Russian life, not only for the soldiers who fight it but for the families who lose them. The ranking is also a reminder of how the war’s cost is distributed: it falls on the young, on the poor and on the regions far from Moscow, and it is felt most acutely in the communities that supply the army’s recruits. Whether the fourth-place ranking survives further scrutiny will depend on the same verification that the headline figures still await, but the claim itself shows how the leak is being read, as evidence of a war that has become a demographic event.
6.2 The 2026 Picture and the Registration Lag
The records are also said to show that the killing has not slowed. So far in 2026, the leaked database records nearly 37,800 military deaths, according to one report on the material, while another figure put the 2026 total at 39,296 by the end of August, a number that is itself likely to be an undercount because of the registration lag. The lag is a crucial detail: only about a quarter of deaths reach the database within a month, and the median delay between a death and its formal registration had stretched past four months by 2025, which means the most recent months in the dataset are the least complete and the true 2026 toll is almost certainly higher than the figures published so far. The lag also means that the leaked totals, which cover deaths registered up to late August 2026, will already be out of date, because deaths from the autumn of 2026 have not yet entered the database in full. The picture that emerges is of a war that continues to kill at a steady rate, with no sign of the toll falling, and of a counting system that lags months behind the fighting. For the families of the dead, the lag means that the official record of a death can arrive long after the funeral, and for the public, it means that the true cost of the war is always worse than the latest figure suggests.
7. Why the Leak Matters Now
The timing of the leak is not accidental, or at least it is not without consequence. The findings were published on November 7, and the Bloomberg investigation followed on November 8, just as Russia, Ukraine and the United States were preparing for the first direct trilateral ceasefire talks since February, scheduled to be held in Abu Dhabi on November 10 and 11, 2026. The talks, mediated by the United States and attended by European representatives, are expected to cover an end to the war, de-escalation and post-war security arrangements, and they are the first time in months that the three sides have sat down together. The leak does not change the terms of those talks, but it changes the context in which they are held, because it puts a number on the cost of continuing the war at the very moment when the parties are being asked to consider ending it. The publication of the figures on the eve of the talks may be a coincidence, but it is a coincidence with consequences, and it is one of the reasons the story has travelled so far so fast.
7.1 The Abu Dhabi Talks
The talks in Abu Dhabi are the most significant diplomatic development in the war for months. They bring together Russia, Ukraine and the United States for the first direct trilateral meeting since February, with European representatives also joining, and they are scheduled for November 10 and 11, the day after this story was published. The agenda is said to cover an end to the war, de-escalation and post-war security arrangements, and the meeting follows a period of intense diplomacy, including the G7 foreign ministers’ meeting in Paris, where Ukraine and Iran topped the agenda. The talks are mediated by the United States, and they come at a moment when the battlefield has been largely static, when both sides have suffered heavy losses, and when the political pressure to find a settlement is growing. The leaked casualty figures do not feature on the formal agenda, but they will be in the room, because every negotiator will know that the war has now cost Russia somewhere between 394,000 and 450,000 dead, and that the cost of continuing it will be measured in the same terms. Whether the figures influence the talks will depend on whether the parties treat them as credible, and that question is still open.
7.2 What the Numbers Mean for the Debate
The leak matters for the public debate about the war as much as for the diplomacy, because it offers the first detailed evidence of a toll that has been hidden for more than four years. For critics of the war, the figures are a measure of its cost, a number that can be set against the territory gained, which independent estimates put at about 73,000 square kilometres since the invasion began, or roughly six deaths for every square kilometre seized, if Silent Crow’s figure is used. For supporters of the war, the figures are a challenge, because they suggest that the official silence has concealed a catastrophe, and because they come from the state’s own records rather than from its enemies. For researchers, the leak is a dataset to be studied, checked and argued over, and the debate about its authenticity and its methods will continue for months. The numbers will not settle the argument about the war, because they are unverified and because they are disputed, but they have changed the terms of the argument, by putting a figure on the table that is too large to ignore and too detailed to dismiss without evidence.
8. What Remains Unconfirmed
For all the detail in this story, much remains unconfirmed, and the gaps are as important as the figures themselves. The database has not been independently verified, the full dataset has not been released, and no third party has published a forensic confirmation of the material, so the headline totals remain claims rather than established facts. The two groups disagree on how much data they took, with estimates of more than 10 terabytes and about 23 terabytes, and they have not explained the discrepancy. The breakdowns by age, region and unit, which would show who exactly has died and where they came from, have not yet been published in full, and the figures for the most recent months are incomplete because of the registration lag. The Russian government has not addressed the substance of the leak, and it has not offered an alternative figure, which leaves the public record with a set of numbers that are detailed, plausible and unverified, and with no official number to set against them. The story is therefore best read as the beginning of an investigation rather than its end, and the questions it raises will take months to answer.
8.1 Questions the Data Cannot Answer
The leaked records, even if genuine, cannot answer every question about the war’s toll. They cover deaths registered in Russia, which means they do not cover Ukrainian military or civilian deaths, and they do not cover the deaths of foreign fighters or of people whose bodies were never recovered. They do not distinguish, in the published figures, between soldiers killed in combat and those who died of wounds, disease or accidents, except in the broad categories used by Silent Crow, and they do not say how many of the dead were conscripts, volunteers or prisoners recruited into the army. They do not record the missing, the soldiers listed as missing whose deaths have not been confirmed, or the unidentified bodies that have never been matched to a name, and the 392,700 figure is almost certainly an undercount for those reasons alone. The records also cannot say how the war has affected the families of the dead, or how many of the deaths were the result of decisions made far from the front, in the ministries and headquarters where the war is planned. Those are questions for historians, for investigators and for the families themselves, and the leaked database, for all its scale, can only begin to answer them.
8.2 What to Watch Next
The next steps in this story will come from several directions at once. Researchers will continue to test the leaked data against what is known, and the publication of a verified sample or a forensic confirmation would be the single most important development, because it would settle the question of authenticity that currently hangs over the figures. The two hacker groups may release more of the data, including the breakdowns by age and region that would show the war’s cost in greater detail, and other news organisations that were given access to the material may publish their own analyses. Rosstat may respond in more detail, either by addressing the substance of the leak or by publishing its own figures, and the Russian government may be forced to acknowledge a toll it has hidden for more than four years. The talks in Abu Dhabi will also be watched closely, because any progress towards a ceasefire would change the context in which the casualty figures are read, and because a settlement would bring its own accounting of the dead. For now, the figures stand as reported, detailed, plausible and unverified, and the coming weeks will provide the answers.
