Cyberattack cuts many internet connections in Ukraine

Ukraine’s largest telecom operator was targeted by a cyberattack on Tuesday that severely impacted internet services in portions of the country, with government agencies blaming Russia.

The attack comes as experts are warning that Russia is likely to intensify its cyberattacks on Ukraine in the winter months and marks one of the largest cyberattacks against a Ukrainian company since the beginning of Russia’s invasion early last year.

Ukrainian telecom group Kyivstar posted in a translated statement on X on Tuesday morning that the company was “the target of a powerful hacker attack” which caused “a technical failure” that led to the company’s telecom and internet access networks collapsing. The company, with about 26 million customers in Ukraine, wrote on X that “our enemies are insidious, but we are ready face any difficulties, overcome and continue working for Ukraine.”

Ukrainian government steps in: The Security Service of Ukraine on Tuesday opened a criminal investigation into the incident, according to a translated statement from the agency, and the SSU suspects that “Russian special services” are behind the attack. The SSU, which is working with Kyivstar to recover from the attack, sent a team to the company as soon as the attack was reported.

But not every agency is rushing to blame Russia. Ukraine’s State Service of Special Communications and Information Protection, the nation’s cybersecurity agency, said in a statement sent to reporters that “it is too early to draw conclusions,” and noted that specialists from Ukraine’s Computer Emergency Response team are involved in responding to the attack.

View from industry: The internet connectivity tracking group NetBlocks posted on X on Tuesday that “connectivity has collapsed” on Kyivstar networks, that the incident impacted “fixed-lined and mobile services" and that the hacking incident "impacted all regions of the country with high impact to the capital." Isik Mater, director of research at NetBlocks, said via email that the attack is "among the most serious faced by Ukraine" since the Russian invasion.

"The incident has clearly had heavy impact to the capital and far beyond, including all major cities and regions, affecting both mobile and fixed-line services with a knock-on impact to dependent sectors including air strike alert systems and banking," Mater said.

Doug Madory, director of internet analysis at the internet observatory company Kentik, further confirmed this, posting on Xthat at one point, mobile traffic on Kyivstar’s network “almost hitting zero.”

Not new: Kyivstar has been a target of cyberattacks from Russia since early in the invasion. The company’s CEO, Oleksandr Komarov, told POLITICO during a visit to Washington last year that the organization’s employees had to scramble to defend against both physical and cyberattacks. In addition, Russian-linked cyberattacks against Ukrainian critical infrastructure have been widespread, including attacks on energy substations.