Finnish defence paper challenging Russian casualty narrative was followed within days by unverified Rosstat death-toll claims

Documented: On 5 February 2026, Finland’s National Defence University repository Doria published Alexander Grable’s conference paper “Irretrievable losses: Casualties in the Russo-Ukraine War (2022-present).” The record lists the paper as presented at the university’s Russia Seminar on 11–12 February 2026. The abstract states that the piece argues against a widely repeated view—including a June 2025 Center for Strategic and International Studies estimate that Russia suffers two to five casualties for every Ukrainian loss—and contends that comparable open data point the other way. Secondary accounts of the paper, including a Substack interview published in late October 2026, say Grable relies on body-exchange ratios, amputee counts, and registry cross-checks, and concludes Ukrainian irretrievable losses substantially exceed Russian ones. That reading is the author’s interpretation of those indicators, not an official Finnish government casualty assessment.

Documented, separately: Rosstat confirmed that its systems were hit by “targeted destructive cyberattacks” between 29 October and 1 November 2026, and said monitoring detected the activity. The agency denied that databases were compromised or that data had been exfiltrated. Belarusian Cyber Partisans and the Ukrainian-aligned group Silent Crow claimed they had penetrated Rosstat, taken on the order of 23 terabytes, and derived war-linked death counts from internal demographic records through late August 2026. Cyber Partisans put a narrower tally at 393,881, counting records tied to military action or its consequences and noting the count likely includes civilians and deaths from other conflicts. Silent Crow’s broader cut reached about 450,100, adding non-combat military deaths, some “terrorist attack” codes, and an estimate for records with no cause. Both groups are banned in Russia as extremist organizations. The Moscow Times, Novaya Gazeta Europe, and bne IntelliNews reported the claims in the days after 7–8 November 2026 and stated the underlying records had not been independently verified in full. Mediazona and BBC Russian, using named obituaries, had confirmed 285,881 Russian military dead as of 6 November 2026 and described that ledger as incomplete. Britain’s defence ministry had earlier put deaths among those fighting for Russia above half a million—an official estimate, not a registry extract.

Claimed: Former CIA analyst Larry C. Johnson, writing on his Substack on 11 November 2026 and amplified by ZeroHedge, argued the leak “arrived right on cue” after Grable’s paper began circulating more widely in late October, and that the sequence has the hallmarks of an influence operation meant to restore a high-Russian-dead narrative. He notes the paper had sat in a Finnish repository since February, so planners would not have needed only the week between viral attention and the claimed breach dates. Johnson’s CIA service was a four-year analyst stint decades ago; since 2022 he has been a frequent guest of Russian state media and a consistent defender of Moscow’s war narrative. That record does not disprove a timing argument. It does mean the suspicion is coming from a commentator whose prior claims have often tracked Kremlin talking points.

Speculated, and not established by the public record: that Western information-warfare offices commissioned, timed, or fabricated the Rosstat figures to answer Grable. No government, newsroom, or the hacker groups themselves has produced evidence of such coordination. The groups say access began months before the destructive phase, which would make a last-minute response to October virality unnecessary even if someone wanted one. Rosstat’s partial confirmation—an attack happened; a leak did not—leaves both “real stolen certificates” and “contested or inflated extracts” open. Overlap with prior independent ranges (Mediazona’s named count below the leak; British estimates above it) is compatibility, not authentication.

What the episode does show is narrower and better sourced. Casualty numbers in this war are not a single official fact. They are produced by incompatible methods—named obituaries, inheritance registries, body exchanges, ICD codes that do not cleanly separate soldiers from civilians, and hacker-derived extracts an agency says were never taken—and each method is then recruited into a political story about who is losing the war of attrition. A heterodox paper hosted by a NATO-member defence university and a high Russian death toll released by partisan hackers can both be real events without either one proving the other’s motive.