Download
← All fact checksAfternoon run · November 8, 2026 · #1 by reach
ConflictTechnologyStatistic

Is the leaked Rosstat data on Russian war deaths real and reliable?

Do leaked Rosstat death records show that up to 450,000 people fighting for Russia or linked to the war have died since February 2022, as hacker groups claim?

True, but…

The breach and the figure range are well supported; the dataset itself is still unauthenticated.

Janis Kluge's thread about the leaked Rosstat death-certificate data is broadly accurate. Rosstat confirmed cyberattacks on 29 October–1 November 2026, hackers published figures of 393,881 and up to 450,100 war-related deaths, and those numbers sit inside other independent estimates. The caveat: the dataset itself had not been independently authenticated, so his confidence it was not manipulated is expert judgement.

+3Sources ↓Original post ↗

Claims

✓ 2 true

Leaked internal Rosstat death-certificate data shows roughly 394,000–450,000 people on the Russian side died in connection with the war in Ukraine between February 2022 and August 2026, and these figures are consistent with other independent estimates.1235

~ True with caveatsCentral claimHigh confidence

The core of the thread holds up. Rosstat confirmed cyberattacks between 29 October and 1 November 2026, and the groups Belarusian Cyberpartisans and Silent Crow published what they say is data from an internal Rosstat 'Demography' database covering February 2022 to August 2026. The two published casualty counts — 393,881 combat-coded deaths and up to 450,100 including non-combat military deaths and unclear cases — were reported by The Moscow Times, Meduza and Novaya Gazeta Europe. They also sit inside a consistent field of earlier estimates: about 350,000 by end-2025 in Meduza and Mediazona's inheritance-registry study, 374,000–770,000 in The Economist's late-October 2026 assessment, and over half a million military dead cited by the UK Defence Ministry in early September. The caveat is the word 'leaked data'. Rosstat denies its databases were compromised, and journalists say the authenticity and completeness of the dataset are still being checked. So the range is credible and widely corroborated, but it rests on data not yet independently authenticated.

Still open: When will independent checks of the dataset's authenticity be published, and will they confirm the death-certificate entries?

Rosstat suffered a cyberattack and an internal database of death records was stolen and published.125

✓ TrueHigh confidence

This is the best-established link in the thread. Rosstat's own acknowledgement that it was targeted between 29 October and 1 November 2026 is reported by The Moscow Times, Meduza and Novaya Gazeta Europe, and HotNews.ro records that Rosstat denied the databases were compromised. The theft claim is separate: the attackers say they took about 23 terabytes including the 'Demography' database, and the two named groups published the casualty counts derived from it. So the attack is confirmed by the victim; the scope of what was taken rests on the hackers' claims and on journalists who have since obtained the data. Because the attack and the leak claim are often reported in one breath, a reader should keep them apart: the first is official, the second is not yet independently authenticated.

Mediazona's named death list is smaller than the leak total because its open-source method cannot capture all those killed in action.14

✓ TrueHigh confidence

This comparative point checks out. Mediazona and BBC Russian had confirmed 285,881 named Russian military deaths as of 6 November 2026, and Mediazona repeatedly states that its verified count is incomplete and the real toll considerably higher. That is the standard explanation for the gap between a named list and a database figure: open-source counting depends on published obituaries, social media and official notices, so it misses people whose deaths are never publicly recorded. The leak's larger total is therefore not a contradiction of Mediazona but a different measurement of a different thing — all death-certificate entries versus publicly verifiable names. The comparison is a useful sanity check, but it does not authenticate the leaked data; it only shows the direction and scale of the difference is expected.

It is theoretically possible but unlikely in practice that the leak was manipulated to inflate the numbers.13

– OpinionModerate confidence

This is a reasoned expert judgement, not a fact that can be verified directly. Kluge's argument rests on the data's consistency with independent estimates, on the regional distribution shown by Mediazona's work, and on Russian budget data on combat-death payouts. Those are legitimate grounds for leaning one way, and they are the kind of cross-checks a researcher would use when a source cannot be fully authenticated. But the hackers' figures have not been independently authenticated, Rosstat denies any leak, and Meduza and Mediazona say they are still working to rule out 'data poisoning' and assess completeness. A reader should treat 'rather unlikely' as a calibrated judgement from someone who knows the field, not as a finding established by the evidence. The honest summary is that manipulation is not evidenced, which is different from manipulation being ruled out.

Still open: Would further technical checks of the dataset change this judgement?

The leaked dataset contains genuine death-certificate entries that can be cross-checked against Russian court records.123

– UnverifiableLow confidence

This is the thread's weakest joint, and it is not something we can settle. Journalists are still checking: Meduza and Mediazona say they have the published data and are working to rule out 'data poisoning' and to assess completeness. The Moscow Times cross-referenced a sample of 50 Mediazona names against Silent Crow's dataset but could not verify the data in its entirety, and Novaya Gazeta Europe states plainly that authenticity and completeness cannot yet be independently checked. Partial matching is a real signal — it is harder to fake records that match a separate, independently compiled name list — but a sample is not the whole dataset. Until fuller checks are published, the claim that the entries are genuine should be treated as plausible and partly supported, not established.

Still open: What did the full cross-checks by Meduza and Mediazona find, and were any poisoned entries identified?

A text-only post: there was no media to test.

What was posted

X

A text-only post on X by Janis Kluge, opening a thread about the leaked Rosstat data. It asks readers to consider whether the leak could have been manipulated to inflate the numbers, and argues that while this is theoretically possible, it is in practice unlikely, before promising to explain why he trusts the leak.

“It's good to question any new and unverified data. It is in theory possible that the Rosstat leak was manipulated to increase the numbers. In practice, it is rather unlikely. What makes me trust this leak? 🧵”

Posted as an X thread by the account @jakluge; the visible post is the opening message, with the reasoning continued in the thread.

Who posted it

X
@jakluge

Account 17.4 years old

View the account on X ↗

Account check

Looks like a genuine account93%
Likelihood of automation3%

Estimates from public signals — account age, posting pattern, audience — not a judgement of the person behind the account, and separate from whether this post is true.

What stood out

  • Handle @jakluge belongs to Dr. Janis Kluge, a known Russia/economics expert at SWP Berlin (German Institute for International and Security Affairs).
  • SWP, ORCID, EUCOM, Carnegie, and Lennart Meri Conference pages corroborate his identity and affiliation.
  • The X account dates to June 2009, with roughly 12.3K posts, indicating a long-standing personal account rather than a new or throwaway profile.
  • He maintains a cross-platform presence on Bluesky (@jakluge.de) with a consistent bio and Russia-economics focus.
  • Posts typically cite primary sources such as Destatis, Bruegel, Russian budget data, and Rosstat leaks, and he has publicly discussed verifying leaked data.
  • No evidence of coordinated inauthentic behavior, bot activity, or fact-checker flags was found.
  • The account is not platform-verified, but this is a weak signal given X's paid verification system.
Signals (7)+
Joined
June 2009
Post count
~12.300
Known affiliation
SWP Berlin / German Institute for International and Security Affairs
Cross platform presence
Bluesky @jakluge.de; Substack
Media citations
Moscow Times, Bloomberg, CNN, Economist, NYT, WSJ, tagesschau
Fact check history
No adverse fact-check findings; publicly discusses data verification
Posting cadence
Regular, analysis-focused

Account checked November 8, 2026, 14:43 UTC

Sources

6 sources reviewed

Further reading

  • 2Meduza Meduza's report sets out both published figures and states that it and Mediazona are checking the data.
  • 3Novaya Gazeta Europe Novaya Gazeta Europe is explicit that authenticity and completeness cannot yet be independently verified, which is the key caveat.
  • 1The Moscow Times The Moscow Times details the attack dates, the figures and how they compare with other assessments.

The full story

The kernel of truth here is a clash between what Russia publishes and what its own records appear to contain. Rosstat, the federal statistics agency, is the body that compiles death registrations. In late October and early November 2026 it acknowledged cyberattacks between 29 October and 1 November, though it denied that databases were compromised. The groups Belarusian Cyberpartisans and Silent Crow say they took about 23 terabytes, including an internal 'Demography' database of death certificates covering February 2022 to August 2026. On 6–7 November they published two figures derived from it: 393,881 deaths explicitly coded as combat-related, and up to 450,100 once non-combat military deaths and unclear cases are included.

What made the numbers feel credible to researchers is that they were not an outlier. Meduza and Mediazona's inheritance-registry study had put the toll at about 350,000 by the end of 2025. The Economist's late-October 2026 assessment gave a range of 374,000–770,000. The UK Defence Ministry said in early September that over half a million had died fighting for Russia. A leak that landed inside all three would not need to be trusted on its own: it would fit a pattern built from unrelated methods.

The gap with Mediazona's named list — 285,881 confirmed by 6 November — also has an ordinary explanation. Open-source counts depend on public obituaries and notices, so they undercount. Mediazona says so itself. The uncomfortable part is that none of this authenticates the dataset. Consistency is grounds for taking a source seriously; it is not proof that the source is genuine.

Kernel of truth

Russia's own statistical agency was hit by cyberattacks, and the casualty figures published by the attackers fall within the range produced by several independent estimates.

Timeline

  1. October 29, 2026

    Start of the cyberattacks on Rosstat, which run until 1 November, per Rosstat's own acknowledgement as reported by The Moscow Times and HotNews.ro. 1The Moscow Times

  2. November 6, 2026

    Mediazona and BBC Russian have confirmed 285,881 named Russian military deaths, a count they describe as incomplete. 4TVP World

  3. November 7, 2026

    Hacking groups Belarusian Cyberpartisans and Silent Crow publish estimates of 393,881 and up to 450,100 war-related Russian deaths from the alleged Rosstat database. 2Meduza

How it was framed

Accurate

The post is a text thread making claims about a data leak, and the check found it broadly accurate: the attack is confirmed, the figures are reported by multiple outlets, and they align with independent estimates. The qualifier is that the authenticity of the dataset itself remains unconfirmed, which is why the verdict is 'true with caveats' rather than a clean true.

  • Borrowed authority. The thread's authority rests on the writer's own expertise and on comparisons with Mediazona, The Economist and Russian budget data rather than on a single source.
  • Missing context. The opening post flags that the data is 'new and unverified' but frames manipulation as 'rather unlikely' before the thread's reasoning is visible to a reader who does not expand it.

Posted on X by the account @jakluge as the opening message of a thread; the post is text-only and the reasoning continues in later posts.

Bias

NoneSlightModerateStrong

Leans favourable to the credibility of anti-Kremlin leaked casualty data. The thread sets out to argue that a leak raising Russian war-death figures is probably authentic, and selects supporting cross-checks in that direction. The points made are transparent and evidence-based, and the author explicitly acknowledges the data cannot be definitively verified, so the slant is mild rather than propagandistic.

Bias describes how the post frames its message — the slant of the language, selection and emphasis — and is judged separately from whether the claim is true. A true claim can still be framed with a strong slant.

How we checked

44 s
  1. 1

    We searched for reporting on the Rosstat leak and on reactions to Janis Kluge's thread.

  2. 2

    We searched for whether the leaked statistics had been described as falsified or manipulated.

  3. 3

    We searched for coverage of the Rosstat hack and the 450,000 casualty figure across outlets, including The Moscow Times, Meduza and Kyiv Independent relays.

  4. 4

    We reviewed the post itself and confirmed it is text-only, with no image, video or audio to assess.

✓ Claim checked– Media not applicable✓ Sources checked

Why 78% confidence

Moderate

The MODERATE band reflects a split picture. The breach, the published figures and their consistency with several independent estimates are strongly corroborated by multiple outlets, which supports HIGH confidence on those elements. But the central qualifier — whether the dataset is genuine — is explicitly unresolved in the reporting, and one claim in the thread is an expert judgement rather than a verifiable fact. That combination supports a firm but qualified verdict, not a clean one.

Limits. We did not obtain or independently analyse the leaked dataset, and no detector was run because there is no media. Authenticity and completeness checks by Meduza and Mediazona had not been published at the time of writing.

What we don’t know

  • Whether the leaked 'Demography' database is genuine and complete, or whether it contains poisoned entries.
  • What Meduza's and Mediazona's full cross-checks of the dataset will conclude.
  • How many of the 393,881 combat-coded deaths can be matched to independently named individuals.
  • Whether Rosstat's denial that its databases were compromised will be maintained or revised.

Spot it yourself

Find the overstatement

Looks suspicious, isn’t proof

  • The post is a thread that opens with a teaser ('What makes me trust this leak?') rather than the evidence, which can look like hedging or self-promotion.
  • The figures come from hacking groups, a category of source many readers instinctively distrust.
  • Rosstat denies that any data was leaked, which can read as official refutation of the whole story.

The actual evidence

  • Rosstat itself confirmed cyberattacks between 29 October and 1 November 2026, so the attack is not in dispute even though the leak is.
  • The leaked range of roughly 394,000–450,000 falls inside earlier independent estimates from Meduza and Mediazona (about 350,000 by end-2025), The Economist (374,000–770,000) and the UK Defence Ministry (over half a million).
  • Mediazona's named list of 285,881 confirmed deaths is explicitly described by Mediazona as incomplete, which explains the gap without requiring the leak to be false.
  • Journalists say authenticity and completeness of the dataset have not been independently confirmed — the reason the verdict is qualified.
  1. 1

    Separate the confirmed event from the claim built on it.

    Ask which part an official body has acknowledged. Here Rosstat confirmed the cyberattack but denied the leak, so the attack is solid and the dataset is the open question.

  2. 2

    Compare the numbers with estimates made by unrelated methods.

    Look for counts based on inheritance records, named obituaries or government statements. If the new figure lands inside those ranges, that is meaningful corroboration — but corroboration of scale, not proof of the document.

  3. 3

    Check whether specialists say the data has been authenticated.

    Read what outlets that obtained the data say about verification, poisoning and completeness. 'Still checking' is different from 'confirmed'.

  4. 4

    Watch for an expert judgement presented as a finding.

    Words like 'rather unlikely' signal a reasoned estimate. Ask what evidence would change the speaker's mind, and whether that evidence exists yet.

Takeaway

A claim can be accurate about the big picture while still outrunning its evidence on one detail. Match your confidence to each part of the claim separately, not to the post as a whole.

Questions people ask

Did Russia's Rosstat really get hacked?+

Rosstat confirmed it was targeted by cyberattacks between 29 October and 1 November 2026, according to The Moscow Times, Meduza and Novaya Gazeta Europe. Rosstat denied that its databases were compromised. The hacking groups Belarusian Cyberpartisans and Silent Crow say they stole about 23 terabytes, including an internal death-certificate database.

Are the 450,000 Russian war deaths from the leak reliable?+

The range of roughly 394,000–450,000 fits other independent estimates: about 350,000 by end-2025 in Meduza and Mediazona's inheritance-registry study, 374,000–770,000 in The Economist's late-October 2026 assessment, and over half a million cited by the UK Defence Ministry. However, the dataset's authenticity and completeness have not been independently confirmed.

Why is Mediazona's count lower than the leak?+

Mediazona and BBC Russian had confirmed 285,881 named Russian military deaths as of 6 November 2026. Mediazona states its verified list is incomplete because it relies on public obituaries and notices. A death-certificate database captures deaths that never appear publicly, so a higher total is expected rather than contradictory.

Could the leak have been faked to inflate the numbers?+

It is possible in principle, but no evidence of manipulation has been published. Janis Kluge argues it is unlikely because the figures align with other estimates, Mediazona's regional distribution and Russian budget data on combat-death payouts. Meduza and Mediazona say they are still checking the data for poisoning and completeness.

What is 'data poisoning' in a leak like this?+

Data poisoning means deliberately inserting false or altered records into a dataset so that anyone who analyses it reaches a wrong conclusion. It is one reason journalists do not publish leaked figures as confirmed fact until they can cross-check entries against independent records.

Go deeper

Rosstat
Russia's federal state statistics service, the agency that compiles official data including death registrations.
Data poisoning
Deliberately inserting false or altered records into a dataset so that anyone analysing it draws a wrong conclusion.
Open-source casualty count
A toll compiled from publicly available evidence such as obituaries, social media and official notices, which tends to miss deaths that are never publicised.
Excess deaths
The number of deaths above what would normally be expected in a period, often used to estimate war tolls when official figures are unreliable.

People also search for

Rosstat leak 450,000 Russian war dead true?Janis Kluge Rosstat leak threadRosstat data leak manipulated numbersRosstat hack casualty figures credible?утечка Росстата 450 тысяч погибших
For educators+
Corroboration across independent methods: how a figure can be credible without the underlying document being authenticated.The difference between an expert judgement and a verifiable fact.Source provenance: separating a confirmed event (the cyberattack) from an unconfirmed claim built on it (the leak).Why open-source casualty counts undercount, and how that shapes the comparison with leaked data.
  • If a leaked document's figures match three independent estimates, how much should that increase your confidence in the document itself?
  • Rosstat confirmed the attack but denied the leak. How should a reader weigh a denial from an interested party?
  • Kluge writes that manipulation is 'rather unlikely'. What evidence would turn that judgement into a finding, and who should produce it?

About this check

Platform
X
Posted by
@jakluge
Posted
November 8, 2026
Age when checked
Under 24 hours old when checked
Where it spread
Russia, Ukraine, Germany
Audience
International audience
Language
EN
Status
● Post is live
Verified
November 8, 2026, 14:44 UTC
Published
November 8, 2026, 14:44 UTC

Reach. Kyiv Independent (7 Nov), Moscow Times (8 Nov), t-online (8 Nov), Cybernews, money.pl, noviny.sk pickup; thread quotes skeptic @AMK_Mapping_ post; Rosstat confirms attacks but denies leak

This verdict was generated with AI from the sources shown. AI can make mistakes — check the sources before relying on it.

Check anything yourself, in seconds.

Share any social post or video to What the Fact and get the verdict, the confidence, and the receipts.

Download on theApp StoreGet it onGoogle Play