Kyivstar cyberattack knocked out mobile service for millions in Ukraine

Kyivstar, Ukraine's largest mobile operator, lost service across the country on December 12, 2023 in what officials called one of the most damaging cyberattacks on civilian infrastructure since Russia's full-scale invasion. Subscribers could not make calls, send messages, reach the internet or log into the company's app, and its website went dark. Kyivstar serves roughly 24 million mobile subscribers and more than 1.1 million home internet customers.

The outage had knock-on effects. Air raid warning systems in the Kyiv and Sumy regions were disrupted, and some state institutions and rival networks felt the strain as users switched providers. The Ukrainian mobile bank Monobank was hit by a large denial of service attack the same day.

A group calling itself Solntsepek claimed responsibility and posted screenshots as proof. Mandiant's John Hultquist said Solntsepek routinely claims work carried out by Sandworm, the Russian military intelligence unit. Ukraine's security service opened criminal proceedings and later attributed the attack to Sandworm, saying the intruders had been inside the network since at least May 2023 and had wiped thousands of virtual servers and workstations before triggering the outage.

Kyivstar said no personal or subscriber data was leaked. The company restored its services by December 20, 2023.