Kyivstar, Ukraine's largest telecommunications provider, was the target of a cyberattack on December 12, 2023. The attack caused widespread disruption to mobile and internet services across Ukraine and is considered one of the most impactful cyberattacks on civilian infrastructure during the ongoing Russo-Ukrainian War.
Background
Kyivstar is a leading Ukrainian telecommunications company, providing mobile and internet services to approximately 24.3 million mobile subscribers and over 1.1 million home internet users. The company is a subsidiary of VEON, an Amsterdam-based multinational telecommunications services company.
Attack
On December 12, 2023, Kyivstar experienced a massive cyberattack that disrupted its mobile and internet services nationwide. The attack also affected critical services, including air raid warning systems in Kyiv and Sumy regions. Ukrainian authorities attributed the attack to Sandworm, a hacker group linked to Russia's military intelligence agency, the GRU. The group Solntsepek, associated with Sandworm, claimed responsibility for the attack, stating they had destroyed Kyivstar's computers, servers, and cloud infrastructure . Illia Vitiuk, head of the cybersecurity unit of the Security Service of Ukraine (SBU), told Reuters that the attackers had been in Kyivstar's systems since at least May 2023 and may have gained full access to its servers in November. He said the attack had wiped thousands of Kyivstar's virtual servers and computers.
Impact
The cyberattack had significant consequences. Millions of Kyivstar customers lost access to mobile and internet services, affecting both personal and business communications. The disruption extended to essential services, including air raid alert systems, compromising public safety during ongoing military conflicts.
Response
Ukraine's Security Service (SBU) initiated an investigation into the cyberattack. In April 2024 its cybersecurity chief Illia Vitiuk said Ukraine had identified Sandworm as the group responsible from its distinctive methods and custom software. He said the SBU was gathering evidence to pass to the International Criminal Court. The court also began examining alleged Russian cyberattacks on Ukrainian civilian infrastructure as possible war crimes, marking a significant development in international law regarding cyber warfare .
Aftermath
Kyivstar undertook extensive recovery efforts, investing $90 million in infrastructure repairs and enhancing cybersecurity measures to prevent future incidents. Kyivstar's parent company VEON put the damage from the attack at 3.6 billion hryvnias (US$93 million). This covered the cost of restoring services, replacing lost equipment and paying outside consultants and partners.