Before the Abu Dhabi talks, a claimed Rosstat leak and hacked alert apps test what can be confirmed

Editor’s Note: Russian, Ukrainian and U.S. negotiators are scheduled to meet in Abu Dhabi on Nov. 10 and 11, their first such session since February. Security guarantees, meaning commitments on what other countries would do if Russia attacked again, top the agenda. Russian President Vladimir Putin wants Ukraine to leave four regions Moscow illegally annexed in 2022 and drop its NATO bid; Ukrainian President Volodymyr Zelensky rejects those terms and seeks an immediate ceasefire.

Two hacker groups published estimates of up to 450,100 war-related deaths from records they say they took from Rosstat, Russia’s statistics agency, which has denied any leak; the groups say the counts likely include civilians. Both countries’ emergency alert apps were hacked; Ukraine blames Russia for its breach and says it struck Russia’s app in response. Bomb hoaxes disrupted European flights with no group or state blamed, and the Institute for the Study of War, a Washington think tank, assesses that Russian forces are very unlikely to control a village Moscow claimed.

For cybersecurity, information governance and eDiscovery professionals, each case turns on provenance: who counted, what was counted and who can confirm it. The same test will apply to whatever account each delegation gives of Abu Dhabi.

News Analysis – Geopolitics Beat

Before the Abu Dhabi talks, a claimed Rosstat leak and hacked alert apps test what can be confirmed

ComplexDiscovery Staff

Russian, Ukrainian and U.S. negotiators are set to open their first talks since February in Abu Dhabi on Nov. 10, and the run-up produced a number that shows how hard this war is to read: 450,100.

That figure is the top of a range one of two hacker groups published on Nov. 7 for war-related deaths in records they say they took from Rosstat, Russia’s state statistics agency. Rosstat has confirmed that it was hit by cyberattacks but denies that any data leaked, and the groups themselves say their counts likely include civilians.

This Ukraine update follows that number and three other developments from the days before the talks: hacked emergency alert apps in both countries, unattributed bomb hoaxes across Europe and a Russian claim to have captured a village. Each leaves a different question open, and the article separates what has been confirmed from what has only been claimed. It then sets those developments beside the positions each delegation carries to Abu Dhabi, drawing on Institute for the Study of War (ISW) assessments from Nov. 6 through Nov. 9, wire and regional reporting, and international commentary on the negotiations.

What the Rosstat files claim to show

The 450,100 figure came from Silent Crow, a pro-Ukrainian group that targets Russian institutions, which works alongside Belarusian Cyber Partisans, an anti-Lukashenko hacking collective. On Nov. 1 the two groups said they had broken into Rosstat’s internal systems and copied about 23 terabytes of data, including military loss figures, census material and personal information, Novaya Gazeta Europe reported. On Nov. 1, Rosstat described the attacks, which it dated from Oct. 29 to Nov. 1, as carefully planned, yet it denied that any databases or legally protected information had leaked, according to The Moscow Times. Russia has designated both groups as extremist and banned them.

The two groups then counted the claimed records in different ways, Novaya Gazeta Europe reported. Cyber Partisans reached 393,881 deaths through Aug. 27, 2026, using entries coded as “military action” or its “consequences” plus records whose text mentions combat, and it acknowledged that the total probably includes civilians and victims of other wars. Silent Crow began from 440,982 records across wider categories, among them 14,160 non-combat deaths of service members and 13,671 people registered in Russia who died in occupied territory or Ukraine with no cause listed. It then estimated that 3,734 to 9,118 more war deaths sit among records with no stated cause, reasoning from the unusually high share of men among those deaths near the front, which yields a range of 444,716 to 450,100. Silent Crow also said the “military action” category does not separate soldiers from civilians and that the files carry no names.

Secondary accounts have flattened those distinctions. ISW, a Washington think tank that publishes daily campaign assessments, described the 440,982 records on Nov. 8 as “deceased Russian servicemembers” and summarized a “reportedly” near-450,000 toll, while the groups themselves say the underlying category mixes soldiers and civilians. ISW also said it could not verify the findings.

A different kind of count offers a point of comparison. As of Nov. 6, Mediazona, BBC Russian and volunteers had confirmed by name 285,881 Russian soldiers killed, Novaya Gazeta Europe reported. Their list draws on relatives’ statements, news reports, official announcements and photographs of graves, and it is known to be incomplete. Russia does not publish comprehensive figures on its military losses, TVP World noted, so no official total is publicly available to test either the named count or the hackers’ range against.

For anyone who handles evidence, this is the authentication problem at national scale. The agency named as the source denies a leak, the provenance of the files runs through the people who say they took them, and the headline number rests on category definitions plus an estimate layered on top of the records. The groups’ published figures, 393,881 and 450,100, sit about 56,000 apart because the groups apply different inclusion rules and Silent Crow adds an estimate on top of its count. Anyone citing such figures in a sanctions analysis, a risk report or a newsroom should name who did the counting, what each count includes and whether the source system confirms the data exists.

Alert apps became a front line before the talks

The emergency alert hacks of Nov. 1 and 2 are better documented, though not fully explained. Late on Nov. 1, Ukraine’s Air Alert app, which warns civilians of incoming strikes, sent users false warnings of nuclear and chemical threats and street fighting, the Kyiv Independent reported. One message claimed Russia’s Oreshnik missile was on its way. The Ukrainian Air Force told users on Telegram that there was no radiation threat, and Ukraine’s Center for Strategic Communications blamed Russia, Al Jazeera reported.

Hours later, Russia’s Emergencies Ministry said its own mobile app had been hit by a “massive cyberattack” that let attackers send false information to the public, without naming who was responsible. Ukrainian President Volodymyr Zelensky then told PBS NewsHour that Ukraine had responded to the attack on its system, according to the Kyiv Independent’s account of the interview, and said Kyiv only answers Russian attacks.

Here the compromises themselves are not in dispute, because authorities on both sides acknowledged them and Kyiv has owned its part. What remains a claim is who breached Ukraine’s app, a question that so far rests on Ukraine’s attribution to Russia. The hacks came as a localized truce around Russian-occupied Oleshky in the Kherson region ended. Al Jazeera called the Oct. 27 to Nov. 1 pause the war’s longest to date, and the Associated Press reported that first lady Melania Trump helped broker it. For security teams, the lesson travels beyond Ukraine: a warning channel people trust is itself attack surface, and incident plans should say how users will be told the truth when the alert system is the thing that was breached.

Hoax threats spread, and attribution has not followed

Europe’s version of the problem leaves even more open. Dozens of flights across the continent drew bomb threats during the week of Nov. 2, forcing searches, diversions and some emergency landings, though the searches turned up nothing suspicious and nobody was hurt, the AP reported. On Friday, Nov. 6, Irish broadcaster RTE, U.K.-based Sky and Bulgaria’s Nova TV also received threats.

The AP reported that authorities had tied the threats to no group or state and that it remained unknown whether they were connected, who was behind them or what they were meant to achieve. An email sent to airport authorities in Rome purported to come from a self-described anti-feminist group, and Dutch military police detained a man at Amsterdam’s Schiphol Airport over one threat and released him the next day. ISW took a firmer analytical view on Nov. 6, assessing that an unidentified actor was running a coordinated campaign likely meant to disrupt European society and impose economic costs, in a manner consistent with Russian approaches. It also noted that no European state had attributed the campaign, so its judgment concerns a pattern rather than a perpetrator.

Matthew Borie of Osprey Flight Solutions, which advises airlines on threats, told the AP “there could be a Russian angle” but cautioned that Iranian hybrid operations are also active in parts of Europe. Jacob Funk Kirkegaard, a senior fellow at the Bruegel think tank in Brussels, described the threats as “stress-testing” the responses of governments and airport officials. In a separate incident on Nov. 7, Italian Foreign Minister Antonio Tajani said personal data about him had surfaced on the dark web, and Prime Minister Giorgia Meloni blamed pro-Russian hackers.

What each delegation carries into the room

Crisis communications also appears in how Washington describes the diplomacy. U.S. negotiator Jared Kushner, President Donald Trump’s son-in-law, said the discussions will focus on “stronger consultation, reliable crisis communications, greater military transparency, and reciprocal measures to reduce escalation risks,” the AP reported. The talks, scheduled for Nov. 10 and 11, are the first trilateral session since negotiators met in Geneva in February, according to AFP and NPR. Vladimir Medinsky, an aide to Russian President Vladimir Putin, again leads Russia’s team. The AP and NPR reported that it also includes Deputy Foreign Ministers Sergei Ryabkov and Mikhail Galuzin, military intelligence chief Igor Kostyukov and Yuri Zhigarlovsky of the General Staff’s operational department. AFP reported that Ryabkov joins the delegation for the first time. Rustem Umerov, head of Ukraine’s Foreign Intelligence Service, leads Kyiv’s side, and Kushner and special envoy Steve Witkoff are convening the session.

Security guarantees top the agenda, the AP reported. Putin wants Ukraine to pull its troops from the four regions Moscow illegally annexed in September 2022 but never fully captured, drop its NATO bid and accept tight caps on its armed forces. He rejects any general ceasefire. Zelensky rejects those terms. Kyiv wants an immediate ceasefire as a first step and a direct Putin-Zelensky meeting to settle territory, along with clear commitments on what Western partners would do if Russia attacked again. “If Russia starts again, what will happen?” Zelensky said in a Nov. 5 interview. “Who will do what, with what means, and when?”

Territory, the core of Putin’s demands, is also where battlefield claims are hardest to take at face value. Russia’s Defense Ministry said on Nov. 9 that its forces had seized Vasylkove, northwest of Hulyaipole, which ISW counted as the ministry’s first claim of a captured settlement since Oct. 28. Pro-Russian sources posted footage that purports to show Russian troops raising a flag there. ISW assessed that Russian forces are “very unlikely to retain any semblance of control” because the village sits about 18 kilometers (11 miles) from the nearest assessed Russian advance or infiltration area. A prominent Russian military blogger had acknowledged a day earlier that the ministry’s seizure claims had slowed sharply.

The distance between the delegations is shown in ISW’s Nov. 7 assessment, which said Russian officials had once more refused security guarantees for Ukraine and tried to keep Europeans out of the negotiations. ISW also reported that Russian Foreign Ministry spokesperson Maria Zakharova called any deployment of foreign forces to Ukraine, whether through the Coalition of the Willing or another alliance, “categorically unacceptable.”

Europe insists on a seat while Moscow keeps the triangle

International commentary before the talks kept returning to Europe’s place at the table. “France will be there and will ensure that Europe’s voice is heard,” French Foreign Minister Jean-Noël Barrot told French radio on Nov. 8, NPR reported, days after the Kremlin ruled out a European role. Umerov said envoys from Britain, France, Germany and Italy, joined by NATO and EU officials, will meet Kyiv’s delegation separately in Abu Dhabi, AFP reported.

Moscow pushed back in two registers. “No one is going to invite them to the negotiating table,” Kremlin foreign affairs adviser Yuri Ushakov said, according to the AP. Kremlin spokesman Dmitry Peskov allowed that because the talks touch on Europe’s future security architecture, broader negotiations would at some stage be impossible “without the Europeans.” AFP reported that the Kremlin said the negotiations would remain trilateral.

Trump widened the frame after meeting Kremlin envoy Kirill Dmitriev at the White House last week. “It’s going to be a big agreement,” he said, according to the AP, and suggested it could take in all of Europe. Kushner wrote on X on Nov. 9 that a lasting settlement would also require “direct engagement between Russia and our European partners on the broader security arrangements that affect them.” German Foreign Minister Johann Wadephul said the same day: “For Europe, it is clear: we do not need to establish a new security architecture for Europe,” AFP reported. Zelensky told CNN he had not been given details of the agreement Trump referenced. “For me, it’s not simple, and it can be dangerous,” he said, invoking the 1945 Yalta conference.

Analysts expect process, not a settlement

Analysts interviewed by Al Jazeera agreed that no peace accord would emerge from the Abu Dhabi talks. Olexiy Haran, a professor of comparative politics at the National University of Kyiv-Mohyla Academy, said technical issues could still move, including grain supplies, a Black Sea ceasefire, an energy ceasefire and another prisoner exchange. Matthew Boyse, a senior fellow at the Hudson Institute and a former U.S. diplomat, was less hopeful. “Putin’s way of negotiating is generally: demand the maximum, escalate, and wait until others compromise,” he said.

Kyiv describes the strikes before the talks in similar terms: Zelensky called the intensified attacks part of Moscow’s strategy of “putting pressure on Ukraine’s position” in the negotiations, AFP reported. According to NPR, Zelensky put the overnight barrage on the Kyiv area going into Nov. 7 at 36 ballistic missiles, only four of them intercepted. NPR also reported that a Nov. 2 guided-bomb strike on an aid distribution point in Komyshuvakha had killed at least 55 people.

The pressure runs in both directions. Russian Central Bank Chair Elvira Nabiullina told the State Duma on Nov. 9 that Ukrainian strikes on oil refineries, data centers, logistics hubs and other industrial sites have constrained Russian production capacity, according to ISW’s account of her remarks. She called those challenges “temporary.” Washington’s politics shifted too: NPR noted the talks follow Democrats’ midterm victories, with a Democratic-controlled Congress due in January.

The talks are set to open with the 450,100 figure no firmer than when it surfaced on Saturday: the top of an estimated range, built on categories that mix soldiers and civilians, from files whose supposed source denies any leak. The other developments carry their own open questions, namely who breached Ukraine’s alert app, who sent the hoax threats and whether they were linked, and whether Russian forces hold Vasylkove. Whatever Abu Dhabi produces this week, a technical truce, a framework or simply an agreement to meet again, is likely to reach the public first as each party’s own account of it. That account will face the same test the Rosstat number has not yet passed: who counted, what was counted and who can confirm it. For cybersecurity, information governance and eDiscovery professionals who inherit leaked datasets and contested statements as evidence, what verification threshold should a record clear before it is treated as the record?

News sources

• Russian Offensive Campaign Assessment, November 6, 2026 (Institute for the Study of War)
• Russian Offensive Campaign Assessment, November 7, 2026 (Institute for the Study of War)
• Russian Offensive Campaign Assessment, November 8, 2026 (Institute for the Study of War)
• Russian Offensive Campaign Assessment, November 9, 2026 (Institute for the Study of War)
• Hackers who broke into Russia’s stats agency say 400,000 to 450,000 Russians have died in Ukraine war (Novaya Gazeta Europe)
• Cyberattack Hits Rosstat as Hackers Claim Huge Data Theft (The Moscow Times)
• Russia-Ukraine peace talks led by U.S. will look at security guarantees for both sides (Associated Press via PBS News)
• US-mediated talks with Russia and Ukraine to start in Abu Dhabi (AFP via France 24)
• Europe to join U.S.-brokered Ukraine talks in Abu Dhabi, defying Kremlin objections (NPR)
• ‘No concession’: What to expect from Russia-US-Ukraine talks in Abu Dhabi (Al Jazeera)
• Russia, Ukraine air raid alert apps hit by cyberattacks after truce ends (Al Jazeera)
• Zelensky confirms Ukraine targeted Russian emergency alert systems in retaliatory hack (Kyiv Independent)
• What to know about the hoax bomb threats that targeted flights in Europe (Associated Press via The Christian Science Monitor)
• Hackers Claim Leaked Rosstat Data Shows 450,000 Russian Deaths (TVP World via Kyiv Post)

Assisted by GAI and LLM Technologies

Additional reading

• Spoofed nuclear alert caps four days of Ukraine war assessments that separate claims from evidence
• Kyiv says Starshield speeds are back, but who capped them is still disputed
• Diesel license, Starshield cap and intelligence warnings strain US support for Ukraine
• Drones hit two Yandex data centers, and a Kremlin decree sets terms for state management
• A cell tower near Lyman and Russia’s fight over its own war record
• How a general’s walk across a bridge tested Putin’s claim to Svyatohirsk
• Germany names Russia for the Leipzig drone, and keeps most of its evidence out of view
• Estonia scrambled jets over a drone no official has identified
• Russia leans on drones and dissent-proofing as fuel crisis bites
• Senate passes Graham sanctions act, shifting Russia pressure from policy to statute

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.