Russia’s vaccination certificates reveal COVID-19 numbers up to five times higher than official statistics

For the past three weeks, Moscow residents could be refused dine-in service at restaurants unless they presented an official QR code proving vaccination, recovery from COVID-19, or a recent, negative PCR test. These QR codes were issued along with certificates, which, as it turns out, are numbered based on encrypted statistics from the Russian Health Ministry’s official coronavirus registry. As part of a joint investigation with Holod Media and Mediazona, Meduza’s journalists studied these certificate numbers, which are issued by the government services portal Gosuslugi, and uncovered that Russia has registered as many as 29 million suspected cases of COVID-19 — a number that’s five times higher than the official statistics reported by the country’s operational headquarters for the fight against the coronavirus.

On June 22, Moscow Mayor Sergey Sobyanin announced that starting in one week, restaurants and cafes in the Russian capital would only offer indoor dining for customers with official QR codes. Muscovites who had been vaccinated, recovered from COVID-19 in the past six months, or received a negative PCR test could obtain these codes through the municipal services portal mos.ru.

This wasn’t supposed to be a short-term measure, and it meant that non-Moscow residents couldn’t enjoy indoor dining in the capital. To fix this issue, a corresponding system for assigning QR codes was set up through the federal government services portal Gosuslugi, albeit with a slight delay. While mos.ru began issuing QR codes on June 28, the Gosuslugi system wasn’t up and running until July 1.

On June 24, Russia’s Deputy Digital Development Minister Oleg Kachanov warned about the delay, citing the need to integrate information from the Health Ministry’s databases with Gosuslugi. “There’s a unified registry of those who have recovered [from the coronavirus] in the Russian Health Ministry’s information resources […] We’ll do this integration and for those who have been ill — and there are about nine million such entries in the registry — we’ll get their [QR codes],” Kachanov said in an interview with the state-owned news channel Russia-24.

The number of recoveries Kachanov cited — around nine million — caused a sensation. According to official data, as of that same day, June 24, just under five million Russians had recovered from COVID-19. However, as journalists from Meduza, Holod Media, and Mediazona discovered, Kachanov didn’t overestimate this number — he underestimated it.

Physicist and statistical anomaly researcher Sergey Shpilkin, who studies vaccination rates, was quick to draw attention to the discrepancy between Kachanov’s claim and the official statistics. And he soon put forward the hypothesis that the real number of recoveries could be estimated based on the numbers on the certificates issued by Gosuslugi — because they were linked to the federal registry of coronavirus cases.

Shpilkin’s hypothesis

Russian physicist Sergey Shpilkin usually researches electoral statistics, but since the start of the coronavirus epidemic in Russia, he’s also started monitoring COVID-19 infection and mortality rates, as well as progress on vaccination. Shpilkin noticed that the vaccination certificates issued by Gosuslugi included a unique patient number — and they appeared to be numbered in sequence.

To verify his hypothesis, Shpilkin asked people to send him the last eight digits of the number on their vaccination certificates. After analyzing the crowdsourced certificate numbers, he came to the conclusion that the same sequence was used countrywide, meaning you could use the last eight digits on any given certificate to work out how many people in Russia were vaccinated at the time it was issued. The numbers Shpilkin obtained fully coincided with the data on vaccinations collected by independent analysts (the Russian Health Ministry has yet to publish this information).

Because the vaccination certificates were numbered in sequence, it occurred to Shpilkin that the certificates proving recovery from COVID-19 would be too. Once again, he turned to crowdsourcing and asked people to send him the last eight digits of their certificate numbers, along with the date of recovery from the coronavirus indicated on the document.

Unique numbers

One Mediazona reader from Moscow came down with the coronavirus in late March. She recovered quickly and two weeks later, in April, her PCR test came back negative. Three months after that, she got a notification from the Gosuslugi app about her “certificate of immunization after COVID-19,” accompanied by a QR code for visiting Moscow restaurants.

The QR code is really just an ordinary hyperlink that leads to a special section of the Gosuslugi website. Restaurant employees in Moscow were supposed to open this link to make sure that a particular customer is cleared for indoor dining. But if you open the link on a computer and look at the page’s code, you’ll see that the certificate number is designated by the abbreviation “UNRZ.” This stands for “unique registry record number” (unikalny nomer registrovoy zapisi, in Russian) — a term that’s used in many of the Russian Health Ministry’s registries and also appears in the code of the vaccination certificates (pictured below).

On June 25, the day after Deputy Digital Development Minister Oleg Kachanov announced the “integration” plan, a description of the scheme for downloading the data “from the COVID registry” appeared on the ministry’s website and on Gosuslugi’s technical portal. In addition to the other data, the 15-digit UNRZ number was supposed to be imported from the registry.

And as Meduza, Holod Media, and Mediazona found out, this same number appears on the recovery certificates issued by Gosuslugi.

Indeed, each recovery certificate has its own 16-digit number: they all begin with “8” and the last eight digits are a unique patient number (the preceding four digits indicate the month and year). If you drop the “8” at the beginning, the last 15 digits of the certificate number are the same as the UNRZ generated by Federal Registry of Persons with the Novel Coronavirus Infection.

When a person’s data is first saved in the coronavirus registry, they’re assigned a 15-digit UNRZ — as demonstrated in the Russian Health Ministry training video (clip below). The UNRZ also includes the date the entry was made — for example, the aforementioned Mediazona reader who recovered from the coronavirus April, received a certificate number with the digits 0321 in the place of the date, presumably because she was diagnosed in March.

In other words, when creating a certificate for a person who has recovered from COVID-19, Gosuslugi simply takes their number from the federal coronavirus registry and sticks the number 8 in front of it (vaccination certificates begin with the number 9).

But since the UNRZ was created when the person in question was added to the federal registry as a coronavirus patient, it turns out that the last eight digits of the number on their recovery certificate actually represent their place in the “sequence” of COVID-19 patients from across Russia.

A Meduza source from a regional health ministry confirmed that the registry uses a single sequence of numbers throughout the country and that it reflects the total number of registered cases at the time when the UNRZ was created for each patient.

Five times the cases

Researcher Sergey Shpilkin collected several dozen certificate numbers and recovery dates, which made it possible to estimate the real scale of Russia’s coronavirus epidemic over the last six months (since the QR codes were only issued to patients who recovered from the coronavirus in the past six months, there are no “older” numbers available from Gosuslugi). The most recent certificate Shpilkin received — from a person who recovered from the coronavirus in late June 2021 — had the sequence number 27,300,000. Meduza asked a federal government source familiar with the work of the official coronavirus registry if this figure corresponds to the total number of entries. He replied, “It does.”

Meduza’s journalists found out that currently, the sequence numbers on the Gosuslugi recovery certificates are already higher than 29 million. This is nearly five times the number of coronavirus patients officially registered in Russia since the start of the pandemic — six million.

Since the certificate number is created at the time of the patient’s diagnosis and the certificate itself is issued only after they recover, the figures on the certificates being issued today reflect the number of entries in the federal coronavirus registry (that is, the number of registered COVID-19 patients) as of two or three weeks ago. As such, it’s impossible to identify the exact dates when the number of the new entries in the registry peaked. Russia officially recorded its highest daily increase in coronavirus cases — 29,935 new patients — on December 24, 2020.

Honest, but inaccurate

That said, the number of entries in the federal registry doesn’t reflect the exact number of recoveries from COVID-19. For example, if a person falls ill for a second time, there will be another record created in the system. And that’s not all.

According to the Russian Health Ministry’s instructions, the coronavirus registry is supposed to include not only people whose “laboratory tests” (including PCR and other kinds of tests) come back positive, but also people diagnosed with COVID-19 “using other diagnostic methods” (such as a CT scan, as per the Health Ministry’s guidelines). In addition, the registry includes “all cases of pneumonia, including outpatients cases.”

As such, Meduza was unable to estimate the proportion of patients included in the registry who had been diagnosed with pneumonia unrelated to COVID-19. Russia’s state statistics service, Rosstat, published data on incidences of pneumonia without COVID-19 for the first months of 2020. However, when Mediazona inquired about more recent statistics, Rosstat replied that they no longer receive separate data on cases of pneumonia from the Health Ministry and Rospotrebnadzor (the federal watchdog for consumer rights protection and human wellbeing).

Moreover, according to Meduza’s source from the federal government, the regions determine which suspected cases to add to the registry themselves: meaning they may only register coronavirus and pneumonia patients, or they may also add questionable cases of respiratory infections, which could account for up to 20–30 percent of the entries in the registry.

“The registry is filled out very honestly, but it’s inaccurate,” the source explained, adding that the data from the regions has to be double-checked at the federal level.

Another potential source of error when making estimates based on the number of entries is the fact that patients whose initial COVID-19 diagnoses aren’t confirmed are removed from the registry — and the freed-up sequence numbers are then assigned to new patients.

‘Your information isn’t true’

Asked to confirm that the certificate numbers are created on the basis on the UNRZs from the Health Ministry’s coronavirus registry, spokespeople for the Digital Development Ministry (the one responsible for Gosuslugi) told Mediazona’s journaliststhat “the Health Ministry’s registry record is used when generating the certificate.”

Meduza and Mediazona also reached out to the Health Ministry and the federal operational headquarters for the fight against the coronavirus with a request for comment on the number of entries in the registry and how it differs from the officially reported number of cases. The operational headquarters asked that we print their comment in full:

The federal information resource for recording information to prevent the spread of the novel coronavirus infection COVID-19 [was] created for official use [and] contains information about the following citizens:

— [Citizens] with a confirmed diagnosis of COVID-19

— [Citizens] hospitalized with symptoms of pneumonia

— [Citizens] vaccinated against COVID-19

Your information about 27 million cases of COVID-19 or pneumonia is not true. The figure 27 million referred to by your source does appear in the information resource, but in relation to those vaccinated with the first vaccine component as of July 9, 2021.

Up-to-date information about the number of COVID-19 cases, including those without clinical manifestations, is reported daily by the operational headquarters to prevent the import and spread of the novel coronavirus infection on Russia’s territory and is published in the public domain on the website stopcoronavirus.rf. As of July 15, 2021, 5,882,295 cases of COVID-19 have been registered in Russia.

In response to clarifying questions about the number of people in Russia who have recovered from COVID-19, the Health Ministry said that the comment from the operational headquarters also reflects their position. According to a Health Ministry spokesman, “the only thing that this figure [27 million] resembles is the number of people vaccinated with the first component as of July 9.” He also urged Meduza’s journalists and their colleagues to base their assessment of the total number of cases on the daily reports from the operational headquarters.

In other words, both the federal coronavirus headquarters and the Health Ministry suggested that in asking about the 27 million entries, Meduza’s journalists and their colleagues had confused the number of registered recoveries with the number of people who had received their first coronavirus vaccine dose.

But this is not the case, as evidenced in the anonymized screenshot (below) of a certificate issued to a person who officially recovered from the coronavirus on February 18, 2021.

The number on the certificate couldn’t be based on the number of entries in the government’s vaccination registry, simply because at that time there were far fewer people vaccinated against COVID-19. The last eight digits of the certificate number begin with 17 — indicating 17 million — but in mid-February 2021, only 11 million vaccine doses had been produced in Russia and only around four million people had been vaccinated against the coronavirus.

Update. After Meduza published this joint investigation in Russian, a reader contacted Mediazona who, due to an error on the Gosuslugi website, received a COVID-19 recovery certificate in July 2021 despite the fact that he was sick with the coronavirus in April 2020. As proof, he provided Mediazona’s editorial board with a screenshot of his certificate and a letter from Gosuslugi, which both listed the same recovery date — May 2020. The digits of the certificate number that coincide with the Health Ministry’s UNRZ indicate a figure slightly higher than 214,000 (the reader asked us not to disclose the exact number). According to official data from the federal coronavirus headquarters, by the end of April 2020, Russia had registered 106,000 coronavirus cases. This is just further proof that Meduza’s journalists and their colleagues didn’t confuse the number of registered coronavirus patients with the number of vaccinations, as the Health Ministry suggested, because in April–May 2020 Russia didn’t have a vaccine against COVID-19. Russia’s “Sputnik V” vaccine was registered in August 2020.

If we assume that the digits included in recently issued certificate numbers reflect the number of coronavirus cases in Russia — i.e., 29 million, — this would put the country in third place for the highest total number of coronavirus cases in the world. In terms of cases per million inhabitants, Russia would rise from 85th in the world to first, bypassing even small states like Andorra and the Seychelles.

Story by Svetlana Reiter and Denis Dmitriev (Meduza), Mikhail Zelensky (Holod Media), and Maxim Litavrin (Mediazona)

Abridged translation by Eilish Hart