Russian hackers from the Sandworm group gained access to the systems of Ukraine’s largest telecom operator, Kyivstar, months before launching a major cyberattack in December 2022. The hackers likely gained initial access as early as March 2023, with full network access by November. They wiped servers, PCs, and core network functions during the attack. Their goals were to cause widespread disruption and gather intelligence. The attack left millions without mobile signal or internet for days. It also disrupted air raid sirens, banks, ATMs and payment terminals. However, Ukraine’s military communications were not impacted as they use separate systems. Kyivstar suffered billions in losses but did not bill customers for a month to apologize.
