incident · 1450828800000

Ukraine Power Grid Cyberattack

A coordinated cyberattack on Ukrainian power distribution companies caused power outages for approximately 225,000 customers.

What happened

Attackers compromised three Ukrainian regional power distribution companies, remotely opened breakers to cause outages, and deployed wiper malware to delay restoration.

Technical mechanism

The attackers used BlackEnergy malware, remote access tools, and KillDisk wiper malware to disrupt operations and erase systems.

Why it matters

The first publicly acknowledged cyberattack to successfully disrupt a power grid.

Impact

Power outages affecting around 225,000 customers for several hours.

Response

Utility operators switched to manual control to restore power and collaborated with international incident response teams.

Defensive lessons

  • Isolate ICS networks from untrusted networks
  • Implement strong multi-factor authentication for remote access
  • Develop contingency plans for manual operation

Evidence register

  1. CISA — Cyber-Attack Against Ukrainian Critical Infrastructure (verified)