Hackers say files from Russia's statistics agency show at least 393,881 killed in the war, and reporters are still testing them

The stories

6 on this beat today.

Every story told the same way: what happened, who is involved, why it matters, how it works, the truth and the good news.

1. 01

   Hackers say files from Russia's statistics agency show at least 393,881 killed in the war, and reporters are still testing them

   393,881

   Russians killed since February 2022, by the count of the hackers who took the files

   Silent Crow, working with them, counts 450,100 [1]

   11 million

   death certificates in the files Bloomberg reviewed

   they run from 2021 to late August 2026 [2]

   0.1%

   gap between the leaked deaths and Rosstat's published deaths for 2021

   the gap is 0.2% for 2022 and about 1% for 2023 [2]

   286,000

   dead Russian soldiers named one by one by the BBC's Russian service and Mediazona

   the list is known to be incomplete [1]

   What happened

   • Hackers say files taken from Rosstat, Russia's state statistics agency, show at least 393,881 Russians killed in the war. [1]
   • That count comes from Cyber Partisans, a Belarusian opposition hacking group, and runs to 27 August 2026. [1][2]
   • Bloomberg News, given the files, found almost 392,700 death certificates that link a death to the war. [2]
   • Silent Crow, a Ukrainian hacking group that worked with them, gets 450,100. [1][2]
   • None of these is an official death toll. [1] Russia has released no combat-loss figures since September 2022. [1]
   • Now the hackers have shared the data with Bloomberg and a small group of other outlets. [2]
   • The hackers say they took about 23 terabytes in all. [1]
   • Bloomberg says the files include more than 11 million death certificates. [2] They run from 2021 to late August 2026. [2]
   • Each certificate gives details such as age, where the person lived and where they died. [2]
   • A record can tie a death to the war with a code. [2] It can also do so in written words such as "shelling" or "drones". [2]
   • Bloomberg says it could not independently prove, with code-based checks, that the database is genuine. [2]
   • But it says the file's hidden details fit a real database export. [2] It found no signs of forgery. [2]
   • The leaked death totals are within 0.1% of Rosstat's published figure for 2021, and within 0.2% for 2022. [2]
   • For 2023, the leaked count is about 1% higher. [2] Thousands of young men's deaths appear to be missing from that year's official figures. [2]
   • Meduza and Mediazona, two outlets that have counted Russian war dead, have begun their own check of the data. [1][2]
   • They want to rule out any deliberate falsification. [1]
   • The BBC's Russian service and Mediazona have named about 286,000 dead soldiers one by one. [1] That list is known to be incomplete. [1]
   • Meduza and Mediazona estimated about 352,000 dead by the end of 2025, using Russia's inheritance records. [2]
   • Euronews says the hackers' figures fit those studies, though that does not prove each number. [1]
   • Bloomberg says the records almost certainly understate the total. [2] Some soldiers are listed as missing, and some bodies were never identified. [2]
   • War deaths are also taking longer to register. [2] The typical delay rose from about 6 weeks in late 2023 to more than 4 months in 2025. [2]

   Who is involved

   • Cyber Partisans a Belarusian opposition hacking group; it counted at least 393,881 dead from the Rosstat files
   • Silent Crow a Ukrainian hacking group that worked with Cyber Partisans; it counts 450,100
   • Rosstat Russia's state statistics agency; it said it found no evidence of a leak
   • Bloomberg News a financial news company; it reviewed the files and found no signs of forgery, but could not prove them genuine
   • Meduza and Mediazona news outlets that have counted Russian war dead; they have begun checking the data

   How it unfolded

   The two groups said on 1 November that they had broken in and wiped Rosstat's servers. [2][3]

   Days later, Rosstat said it had found no evidence that confidential information had leaked. [2]

   1. 1 Nov Hackers say they broke into Rosstat and took data [2]
   2. Days later Rosstat says it found no evidence of a leak [2]
   3. Now the counts come out
   4. Sept 2022 Russia last releases figures on combat losses [1]
   5. 8 Nov The hackers' counts and Bloomberg's review come out [1][2]

   Why it matters

   Russia made military losses a state secret in 2015. [2] Rosstat then stopped publishing many figures after the 2022 invasion. [2]

   Bloomberg calls the files a rare look at what the war has cost Russia. [2]

   The next test is whether Meduza and Mediazona find the files genuine and complete. [1]

   How it works

   Statisticians call this an operational definition: the exact rule for what gets counted.

   Cyber Partisans counted deaths listed as caused by the war. [1] Silent Crow added non-combat military deaths and deaths of unclear cause in occupied land, so it counted more. [1]

   Seen it before

   Count only the pupils away with flu and you get one number. Count every absent pupil and you get a bigger one.

   The truth

   • What is really going on Cyber Partisans and Silent Crow took files from Rosstat, and the counts of Russian dead now circulating began with what they took and how they chose to count. [1][2]Bloomberg found no sign of forgery but could not prove the files genuine, so the figure is still the hackers' count. [2]
   • Why it works on people An exact figure such as 393,881 looks as if someone counted everyone, when it depends on which deaths the counters chose to include.
   • Bloomberg and the hackers worked from the same files, so their close totals cannot show the files are real. [2]
   • Rosstat did not respond to Bloomberg's request for comment. [2]
   • Who gains Researchers counting Russian war dead — More than 11 million certificates give them records to set against their own estimates. [1][2]
   • Who pays Men in Russia's remote regions — In Buryatia, Tuva and Zabaykalsky, about one-third of men aged 18 to 49 who died up to mid-2024 were recorded as war deaths; in Moscow and St Petersburg it was about one in 10. [2]
   • Nobody knows yet

     Whether the Rosstat files are genuine and complete.

     Bloomberg could not prove the database genuine, and Meduza and Mediazona have only begun their check. [1][2]

   • Nobody knows yet

     How many Russians have really died: the hackers say at least 393,881, Bloomberg found almost 392,700 certificates, Silent Crow says 450,100.

     The three counts use different rules, and the records miss people listed as missing or never identified. [1][2]

1. 02

   Iris Ohyama data on 7.7 million exposed

   What happened

   • Iris Ohyama, a big Japanese maker of household goods, says data on about 7.7 million people may have been exposed. [4]
   • Hackers got into an outside cloud storage service used by its online shop, Iris Plaza. [4]
   • Up to 5.8 million are members or former members. [4] Another 1.9 million never joined. [4]
   • Names, addresses, phone numbers, emails and birth dates may be out. [4] Members' passwords were stored encrypted, meaning scrambled, and none were kept for former members. [4]
   • The company says card numbers were not held in that cloud service. [4]
   • Iris Plaza shut its shop on 28 October and told Japan's privacy regulator and police on 29 October. [4]

   How it unfolded

   1. 28 October shop suspended
   2. 29 October regulator and police told

   Why it matters

   Up to 7.7 million people must wait to learn whether their own record was taken, because Iris is still counting. [4]

   How it works

   Security teams call this third-party risk: data held by a supplier is only as safe as that supplier.

   Iris Plaza kept customer data with an outside cloud firm, so a break-in there reached the shop's customers. [4]

   Seen it before

   Leave your bag at a friend's house and it is only as safe as that friend's front door.

   The truth

   • Iris says it has heard nothing from the attacker and has not identified who did this. [4]
   • Who pays Iris Plaza customers — They must wait while the company works out whose records were reached. [4]
   • Nobody knows yet

     How many Iris Ohyama records were actually taken.

     The company is still working out how many records were exposed, and the 7.7 million is an upper limit. [4]

   • Nobody knows yet

     Who broke into the cloud service Iris Plaza used.

     Iris told BleepingComputer it has had no contact from the attacker and has not identified them. [4]

2. 03

   Britain's former cyber chief: a bad run

   What happened

   • Ciaran Martin, the first head of Britain's cyber agency, the NCSC, says recent hacks are "a bad run". [5] He adds that they are "not unprecedented". [5]
   • Martin pointed to the NotPetya and WannaCry attacks of 2017, and to a surge of ransomware in 2021. [5] Ransomware locks a victim's files until money is paid. [5]
   • Flaws found by leading tech companies have soared 8-fold since April, when Anthropic released its Mythos AI model. [5]
   • Attacks have not risen by as much. [5] Security expert Tal Be'ery suggests criminals are struggling to make money from the flaws. [5]
   • Britain's NCSC says the fridge attackers "really didn't need" AI. [5] Default passwords were printed in one fridge firm's manuals. [5]
   • Finland's cybersecurity centre recorded nearly 21,000 incidents last year, up from about 13,000 in 2022. [5]

   How it unfolded

   1. 2017 NotPetya and WannaCry
   2. 2021 a surge of ransomware
   3. Now "a bad run"

   Why it matters

   Owners of older equipment carry this: Danfoss says most affected fridge systems no longer get security updates. [5]

   How it works

   Security teams separate a vulnerability, a flaw, from a threat, someone able to use it.

   Flaws found rose 8-fold, but attacks rose less. [5] Tal Be'ery's explanation is that a flaw needs someone able to profit from it. [5]

   Seen it before

   A door left open only matters if someone comes along and wants to go in.

   The truth

   • The Guardian says Be'ery has speculated about this, so the reason attacks lag is not settled. [5]
   • Who gains Attackers going after old equipment — Most of the fridge systems hit no longer get security updates, so the holes stay open. [5]
   • Who pays Owners of older fridge systems — Danfoss says it has long advised updating or replacing old software, so that cost sits with them. [5]
   • Nobody knows yet

     Whether Russia was behind the supermarket fridge attacks.

     One expert says the methods point that way, but adds that he is not certain they are Russian groups. [5]

1. 04

   Torvalds sees AI bug-fix flood easing

   What happened

   • Linus Torvalds, who leads work on Linux, says the flood of AI-found flaws may be starting to ease. [6]
   • He said so as he released the second test version of Linux 7.4. [6] The first was the largest such release in Linux's history. [6]
   • Developers have found more flaws since April, when Anthropic launched its Mythos bug-finding model. [6]
   • Microsoft fixed 206 flaws in June, 622 in July and a record 974 in September. [6]
   • Oracle fixed 1,449 flaws in a single month. [6]

   Who is involved

   The core of Linux, a system that runs computers, has more than 40 million lines of code. [6]

   How it unfolded

   1. First test version largest ever
   2. Second test version still big

   Why it matters

   That is many more fixes than IT teams can handle. [6] Attackers are also going after AI-found flaws more and more. [6]

   How it works

   Queueing theory, part of operations research, studies how a line grows and shrinks.

   Most parts of Linux have not reached the point where fixes outpace new reports, Torvalds says. [6] So their pile of flaws is not shrinking yet. [6]

   Seen it before

   A shop queue only gets shorter when the till serves people faster than new ones join.

   How to test whether a leaked file is real

   Historians call it source criticism: ask where a record came from, and whether it fits records its leaker could not change.

   The twist

   A leaked file cannot vouch for itself. The real test is a record the leaker never had the chance to change, such as totals the agency published years before.

   The picture

   20210.1% gap

   20220.2% gap

   20231% gap

   Step by step

   1. 1 A document turns up with no one to vouch for it
   2. 2 Ask who made it and how it got out
   3. 3 Check it against itself: its dates and hidden details
   4. 4 Check it against records the leaker could not change
   5. 5 A record that passes earns trust, not proof

   The same force, elsewhere today

   Where this chain is also running, in today's other stories.

   • The flood of AI-found flaws

     A count of flaws found goes up 8-fold, and the test is the separate count of attacks, which has not risen as much.

   • Torvalds and the bug fixes

     He passed on a developer's claim that fixes outrun reports and wrote "if true", because the claim has no outside count behind it yet.

   Where you've seen this

   Fake diaries

   Forged Hitler diaries sold in 1983 were exposed when tests found paper made after his death.

   Art dealers

   A painting's paint is tested for pigments not made until after the painter died.

   Courts

   A chain of custody records who held each piece of evidence, so a judge can see how it arrived.

   The catch

   Passing every test shows a file has not been caught out. A patient forger could still copy the published totals and change the rest.

   And the whole of it

   Clerks at Rosstat, the families of the dead, the hackers and the reporters each hold a small part of this. Most of us reading the number have only the word of the people who checked it.

   The truth

   • The claim comes from one developer, Alexei Starovoitov, and Torvalds said it "sounds lovely if true". [6] He added: "Don't hold your breath". [6]
   • Who pays IT teams — They face more fixes than they are set up to apply, as attackers go after AI-found flaws. [6]
   • Nobody knows yet

     Whether the flood of AI-found flaws has really peaked.

     Torvalds says only that one part of Linux is ahead, and most other parts are not. [6]

   Good news

   • Fixes for bpf, one part of Linux, are now arriving faster than new reports of flaws, its lead developer says. [6]

1. 05

   Binance's finance chief leaves after heist

   What happened

   • Binance's finance chief, Kaiser Ng, is leaving, about a week after hackers stole $6.3 billion in crypto from its users. [7]
   • Co-chief executive Yi He said Ng will "pursue a new venture" after more than five years. [7]
   • Yi He said a handover plan had been in place for six months. [7] Justin Yek takes over as finance chief. [7]
   • Binance and the FBI blamed a North Korean group called TraderTraitor for the hack. [7]

   Who is involved

   Binance is the world's largest cryptocurrency exchange, where people buy and sell digital coins. [5]

   • Kaiser Ng leaving
   • Justin Yek takes over

   Why it matters

   After accounts unfroze, users took out a net $3.6 billion in the first few hours. [7]

   The truth

   • TechCrunch's report of the exit does not link Ng's departure to the hack. [7]
   • Who gains Binance's users — Binance says the losses will not be passed on to them. [7]
   • Who pays Binance — It has promised to cover the theft from its own money. [7]
2. 06

   Vietnam unveils homegrown security chip

   What happened

   • Vietnam's government announced the country's first domestically designed security chip last week. [8]
   • The Register says it apparently has encryption, the scrambling that protects data, built into the silicon. [8]
   • It is already in the secure USB drives used by Vietnam's government, defence agencies and Communist Party. [8]
   • Vietnam hopes to use it for national digital signatures and for power, water, oil, gas and telecoms systems. [8]

   Why it matters

   Vietnam's government calls it an important step towards making its own security tools. [8]

   How it works

   Security engineers call a chip that guards a system's keys its root of trust.

   Vietnam's secure drives store state data behind this chip, so those files are only as safe as it is. [8]

   Seen it before

   The lock on a diary protects it only if the lock itself is not broken.

   The truth

   • Vietnam's government says the chip needs more testing before it will trust it with state secrets. [8]