Back
Automatically translated version. May contain inaccuracies compared to the original.
How the occupiers killed Kyivstar, which still belongs to Putin’s “wallet”
A hacker attack by the rashists stopped the operation of the country’s largest mobile operator (which still indirectly belongs to rashist Friedman). 24 million subscribers were left offline. How did this happen and when will service be fully restored?
In June Kyivstar had 24,1 million mobile subscribers and over 1,1 million fixed‑internet subscribers, reports EKONOMICHNA PRAVDA.
The attack on the largest mobile operator did not just cut off half of Ukraine’s population. The assault hit a wide range of businesses dependent on the operator’s connectivity, government institutions, and even Kyivstar’s competitors, which were not prepared for a significant traffic surge from the influx of new users.
In the morning Kyivstar called the outage a technical glitch, and by evening — a powerful cyberattack that significantly damaged the operator’s IT infrastructure.
Ukraine’s security service assumes Russian intelligence services may be behind the attack. Since the start of the full‑scale war Kyivstar has been subjected to cyberattacks more than once, but each time it successfully repelled them. This time, it seems, the enemy achieved its objective.
How everything “fell apart”
On 12 December at 8:04 a.m., the mobile operator Kyivstar reported a technical failure and possible service and Internet access limitations for some subscribers. “The company’s specialists are working to eliminate the problem,” the statement said.
At the same time, internal chats of Kyivstar employees contained messages about a cyberattack on the network core and the operator’s databases. Anonymous Telegram channels simultaneously began spreading false information about alleged law‑enforcement searches at the company’s office.
Within a few hours it became clear the problem was far more serious. In addition to mobile voice and Internet, the Kyivstar mobile app “My Kyivstar,” Kyivstar home Internet and the operator’s website were down.
Ukrainians using Kyivstar mobile and home Internet were left without service nationwide. Attempts to switch operators did not help. The Ministry of Digital Transformation reported that Kyivstar subscribers could not port to other operators because the company’s network failure affected national roaming.
Later, the minister for community development, territories and infrastructure, Oleksandr Kubrakov, said repair work was underway in the mobile operator’s network that could last four to five hours.
By midday the company acknowledged the large‑scale outage was caused by a powerful hacker attack: “As of now it is known that subscribers’ personal data were not compromised. At this time the operator’s specialists are working to mitigate the consequences of the hacker attack to restore connectivity and services as soon as possible.”
The company also hastened to assure that subscribers who lost service or could not use the operator’s services would receive compensation.
What really happened
The cyberattack on Kyivstar resulted in the largest outage among all Ukrainian operators in recent years, said Oleksandr Fediyenko, head of the Verkhovna Rada subcommittee on cybersecurity.
According to a government source who spoke to EP, the attack on Kyivstar is the result of prolonged and grandiose hacker work. “Even before the large‑scale war Russian hackers repeatedly tried to attack Ukraine’s critical infrastructure, including mobile operators. Kyivstar had a strong protection system against cyberattacks; they invested heavily and over the last two years demonstrated its effectiveness,” the source told EP.
“We recorded an increase in cyber and hacker attacks since the start of the full‑scale invasion of about 400%. We faced this constantly. Currently this is the most powerful attack since the start of the large‑scale war,” said Kyivstar’s corporate communications director Anna Zakharash.
An attack on the network core is a serious blow to an operator because it handles all traffic transmitted through the mobile network. That traffic includes voice calls, SMS and mobile Internet.
To document the circumstances and consequences of unlawful interference with Kyivstar’s network, the operator involved law enforcement and security agencies. The State Service of Special Communications said it is too early to draw conclusions.
“An investigation of the incident that caused the technical failure and temporarily made communication and internet access services unavailable is underway by the specialists of the relevant services. Among others, specialists from the government incident response team CERT‑UA are involved in this work,” the agency responded.
One version being investigated by SBU investigators is the involvement of Russian security services in the hacker attack.
Kyivstar CEO Oleksandr Komarov emphasized that the cyberattack was very powerful and partially destroyed the operator’s IT infrastructure.
“Our IT specialists had no access to internal systems. The entire perimeter protected by a special directorate, where all rights are defined, was completely destroyed. Therefore we had to act at the physical level, connecting, so to speak, via patch cords to each network element to understand the level of destruction at this time,” Komarov said.
Following the hacker attack on Kyivstar, the SBU opened a criminal case under eight articles of the criminal code.
“After the incident, an SBU operational‑investigative group went to the company’s offices to document all circumstances of the attack. Cyber specialists from the SBU are also working at the scene, assisting Kyivstar staff and coordinating efforts of all state institutions for the fastest possible network recovery,” the agency told EP.
What the outage affected
Mobile operators ensure the functioning of many sectors of the economy. Banking infrastructure runs over their Internet. Major institutions reported ATM and payment terminal malfunctions.
“A large‑scale outage of Kyivstar’s services resulted in a portion of Oschadbank’s ATMs, POS terminals and information‑payment terminals becoming inoperative. Full restoration will take place after Kyivstar’s service outage is eliminated,” Oschadbank’s press service said.
Problems were also reported at PrivatBank — the country’s largest bank: “Due to Kyivstar’s difficulties, some POS terminals, ATMs and self‑service terminals may operate unstably or have no connection.” According to EP’s sources inside the financial institution, up to 5% of ATMs, up to 10% of self‑service terminals and up to 30% of POS terminals depend on Kyivstar.
Raiffeisen Bank’s press service also reported issues in payment infrastructure: “Some POS terminals may be partially unavailable at store checkouts. We recommend using another bank’s terminal or paying with cash.”
Other large banks experienced smaller problems due to Kyivstar’s outage. PUMB reported difficulties with authentication of certain operations: “Clients may experience some issues receiving SMS and push notifications with authentication codes for payment operations.”
Besides the indirect impact on the banking system, hackers intensified attacks on banking infrastructure during the day. “A massive DDoS attack on Mono. Target: Amazon entry points (banks, site),” monobank co‑founder Oleh Horokhovskyi reported at about 13:00. The attack was repelled in less than an hour.
Representatives of other banks and the NBU did not record increased hacker activity. “All information systems of the National Bank operated without interruption and continue to do so. In particular — the electronic payments system used by banks, the official website and the NBU’s internal computer network,” the NBU press service reported.
The outage at the country’s largest operator also affected other businesses. Taxi service Uklon reported a noticeable drop in order activity because a large share of customers lost connectivity.
“To guarantee uninterrupted address service, we provided couriers with SIM cards of alternative operators. Couriers contact clients by all available means,” Nova Poshta’s press service said.
The Kyivstar outage also affected the civil defense alert system. In particular, air‑raid alerting systems temporarily did not function in Sumy region and in some towns of Kyiv region: Bucha, Irpin, Vyshneve, Berezani, Skvyra, Rzhyshchiv, Tarashcha and Volodarka.
“In settlements where the system is not working, patrol police and SES crews will operate. They will announce air danger by loudspeaker,” the Kyiv regional military administration reported.
In Lviv, due to connectivity problems, streetlights could not be switched off automatically, so municipal services had to disconnect street lighting lines manually.
Why national roaming did not work
Since the start of the full‑scale war, a contingency plan — national roaming — exists to handle operator outages: the ability of one operator’s subscribers to use other operators’ infrastructure. But this plan did not work.
The Ministry of Digital Transformation explained that national roaming did not function because Kyivstar’s network could not transmit subscriber information to other operators’ networks.
The company added that national roaming was impossible due to partial destruction of HLR/HSS systems — subscriber data registries. “The registries are blocked, so there cannot be access to national roaming. We are not allowing external connections into the network, even if they are verified as our partners,” Komarov said.
The Ministry of Digital Transformation added that this is a temporary problem that all Kyivstar specialists are actively working on.
What about the other operators
As a result of Kyivstar’s outage, other operators — Vodafone and lifecell — were affected. Due to increased traffic, these companies reported temporary problems with their websites and apps.
Because many Kyivstar customers began moving to other operators, the latter’s infrastructure load increased. “Network load has increased, and the number of inquiries from our and other operators’ subscribers about the mobile situation has also grown. Because of this some Vodafone subscribers may experience limitations accessing service portals. Mobile services are fine, the network is operating as usual,” Vodafone said.
Lifecell also reported increased load. “In the lifecell network there are difficulties topping up accounts, activating new subscribers, and with the website and app. At the same time our network’s operation is currently stable. Traffic to our site increased more than fivefold; demand for eSIM increased tenfold,” the company said.
Other mobile operators say they are working to strengthen protection against cyberthreats. They do not disclose details of such preparations.
“Our specialists record cyberattacks daily. We constantly strengthen and improve network protection, adapt new protection mechanisms and technical solutions to current threats so subscribers can freely use services,” lifecell’s press service said.
When will Kyivstar be restored
It is impossible to say exactly when the operator will resume services. After 12 hours without service, Kyivstar could not predict the restoration time.
Later the company spokeswoman Iryna Lelichenko said specialists “will do everything possible to finally complete this work by 13 December 2023.” “Service restoration may occur gradually, about which we will provide additional updates,” Kyivstar explained.
Serviceman, engineer and volunteer Serhiy Fles suggests restoration could be possible within a day: “What happened has never occurred anywhere and at any time (in scale) in the entire history of mobile communication and beyond in Ukraine. My estimate for fixing the situation is a day from the start of repair work. In a best‑case forecast.”
Government sources say in the worst‑case scenario restoration could take several days.
Kyivstar’s CEO stressed that the company is receiving help from major suppliers — Ericsson and Microsoft. “Everyone helps as they can because different equipment and technologies from different suppliers operate on different network elements. Each hour as we determine the level of damage we connect these suppliers to start negotiating,” Komarov said.
He added the operator is partially providing fixed Internet service, but if the situation can’t be fixed it will stop working approximately at midnight on 13 December.
By the end of the day on 13 December, voice service began to be partially restored.
An outage before nationalization?
The hacker attack on Kyivstar happened as the state began preparing for its possible nationalization. “Relevant services are now studying the legal situation. I think there is a high probability of imposing sanctions followed by confiscation of this company,” Deputy Head of the Office of the President Rostyslav Shurma explained.
Earlier, a court had arrested all corporate rights in Ukraine belonging to sanctioned Russian oligarchs Mikhail Fridman, Pyotr Aven and Andrey Kosogov, who are in Putin’s circle and finance Russian aggression. Among the assets seized by the court were shares in Kyivstar and a smaller stake in another mobile operator — lifecell.
In October it was reported that the Ministry of Justice is preparing a lawsuit to the High Anti‑Corruption Court to seize assets of sanctioned Russian oligarch Mikhail Fridman in favor of Ukraine, including part of the mobile operator Kyivstar.
Document: PDF proof of the original version of the news item "Як окупанти вбивали "Київстар", який і досі належить путінському "гаманцю"". It records the publication content at the moment of the first scan, the preservation date and the source: ANTIKOR.
