Cyberattack knocks out Ukrainian railway Ukrzaliznytsia's online ticketing

Ukrzaliznytsia, Ukraine's state railway operator, was hit on 23 March 2025 by an attack that took down its website, mobile application and online ticket sales. The company confirmed the incident publicly the following day and described it as systematic, complex and multi-layered.

Train movements were unaffected and services ran to schedule. Operational processes were switched to backup and paper-based methods, which slowed the handling of freight shipping documents and required additional staff. Passengers were pushed to station ticket offices, producing long queues at Kyiv's central station and elsewhere. Ukrzaliznytsia doubled the number of ticket windows and staff at busy stations and told travellers they could buy tickets on board.

The operator worked with the Security Service of Ukraine's cyber department and with CERT-UA on the response, and said it needed to test for vulnerabilities before restoring systems from backups. Online ticket sales resumed on 27 March after what the company said was 89 hours of continuous work, with more than 12,000 passengers buying tickets online on the first day back. Chief executive Oleksandr Pertsovskyi said no sensitive information had been compromised.

No group claimed the attack and Ukrainian agencies made no formal public attribution, although the railway's own statements referred to an enemy and previous attacks on Ukrainian critical infrastructure have been attributed to Russian state hackers. On 31 March the Moscow metro's website and app went down, briefly displaying text resembling Ukrzaliznytsia's own outage notice. Moscow's transport authority blamed ongoing technical maintenance.