Russian cyberattack on Kyivstar, a Ukrainian telecommunications provider
The 2023 Kyivstar cyberattack was a significant cyber incident targeting Kyivstar, Ukraine's largest telecommunications provider, on December 12, 2023. The attack caused widespread disruption to mobile and internet services across Ukraine and is considered one of the most impactful cyberattacks on civilian infrastructure during the ongoing Russo-Ukrainian War.[1][2]
Background
Kyivstar is a leading Ukrainian telecommunications company, providing mobile and internet services to approximately 24.3 million mobile subscribers and over 1.1 million home internet users. The company is a subsidiary of VEON, an Amsterdam-based multinational telecommunications services company.[3]
Attack
On December 12, 2023, Kyivstar experienced a massive cyberattack that disrupted its mobile and internet services nationwide. The attack also affected critical services, including air raid warning systems in Kyiv and Sumy regions.[2][4] Ukrainian authorities attributed the attack to Sandworm, a hacker group linked to Russia's military intelligence agency, the GRU. The group Solntsepek, associated with Sandworm, claimed responsibility for the attack, stating they had destroyed Kyivstar's computers, servers, and cloud infrastructure .[5]
Impact
The cyberattack had significant consequences. Millions of Kyivstar customers lost access to mobile and internet services, affecting both personal and business communications.[1] The disruption extended to essential services, including air raid alert systems, compromising public safety during ongoing military conflicts.[4]
Response
Ukraine's Security Service (SBU) initiated an investigation into the cyberattack, gathering evidence for potential prosecution. The International Criminal Court also began examining alleged Russian cyberattacks on Ukrainian civilian infrastructure as possible war crimes, marking a significant development in international law regarding cyber warfare .[6][7]
Aftermath
Kyivstar undertook extensive recovery efforts, investing $90 million in infrastructure repairs and enhancing cybersecurity measures to prevent future incidents.[3]
