Kyivstar wiper attack

On 12 December 2023, Kyivstar, Ukraine's largest mobile operator, suffered what officials called one of the most damaging cyberattacks on Ukrainian infrastructure since Russia's full-scale invasion. A wiper attack destroyed thousands of virtual servers and workstations, knocking out mobile and Internet service for roughly 24 million subscribers and cascading into air-raid alerts, banking and payments.

What happened

According to Ukraine's SBU security service, Sandworm operatives had been inside Kyivstar's network since at least May 2023, likely entering through a compromised employee account. By November they had achieved full access to the company's IT infrastructure, giving them months of reconnaissance before striking.

On 12 December the attackers detonated a large-scale wiper, erasing "almost everything" — thousands of virtual servers and personal computers across Kyivstar's core systems. The destruction was so comprehensive that Kyivstar had to rebuild much of its IT environment from backups, a process that kept services down for days.

Impact

• ~24 million subscribers lost mobile voice, SMS and Internet connectivity; for many, service was unavailable for several days.
• The outage disrupted air-raid warning systems in some areas, ATM and card-payment networks, and retail point-of-sale terminals, as people queued to buy rival SIM cards.
• Mobile and Internet services were largely restored by 20 December, about a week after the attack.
• Kyivstar's parent, VEON, reported the incident did not breach subscriber personal data, but the operational and financial impact ran into the tens of millions of dollars.

Attribution

Ukrainian authorities attributed the attack to Sandworm, the cyber-sabotage unit of Russia's military intelligence (GRU Unit 74455). The pro-Russian hacktivist group Solntsepyok claimed responsibility, but the SBU assessed it as a front for Sandworm. Ukraine announced it was gathering evidence to potentially prosecute those responsible as war crimes at international tribunals, given the attack's impact on civilian emergency-warning systems.

Why it matters

The Kyivstar attack demonstrated that telecommunications networks are prime wartime targets: disabling a single carrier rippled into emergency alerts, finance and daily life for millions. It underscored the danger of long-dwell intrusions — months of undetected access enabling a single, catastrophic destructive event — and the strategic value adversaries place on civilian connectivity. Western agencies treated it as a warning that similar destructive operations could be turned against telecom providers beyond Ukraine.