The Day Ukraine’s Cellphone Network Went Dark Nationwide: The Cyberattack on Kyivstar

On the morning of December 12, 2023, the network of Ukrainian mobile phone company Kyivstar (Київстар) was knocked offline by a cyberattack from outside the company. Its parent company VEON (headquartered in Amsterdam) disclosed the same day that Kyivstar’s network had been the target of a "widespread hacker attack," and that calls and internet connectivity had become temporarily unavailable. It came in the winter, nearly two years after Russia’s full-scale invasion.

Kyivstar is the country’s largest mobile phone company. According to VEON’s annual report, as of December 31, 2023, it had 23.9 million mobile phone customers in Ukraine.

What Stopped Working

The annual reports of VEON and of Kyivstar Group, which later went public, describe the services that the attack knocked out: voice calls and data over both the mobile and fixed-line networks, international roaming, and SMS, among others. The impact reached not only subscribers inside the country but also those abroad.

In its disclosure on the day of the attack, VEON said that, as far as the company knew at that point, subscribers’ personal data had not been compromised. The next day, December 13, Ukraine’s Security Service (SBU) announced that Kyivstar’s digital infrastructure had suffered "critical damage," and that restoring all services while following safety procedures would take time.

The Week It Took to Restore Service

Service came back in stages. Here is a timeline of the company’s announcements.

One week passed between the attack and the announcement that all services had been restored. In their announcements on the 14th and 15th, VEON and Kyivstar thanked law enforcement, the SBU, and government agencies for their cooperation in the restoration effort.

SBU’s Announcements

On the day of the attack, December 12, the SBU announced it had opened criminal proceedings under eight articles of the criminal code: unauthorized interference with computer networks (Article 361), the creation and spread of malicious programs (Article 361-1), as well as sabotage (Article 113), planning and waging a war of aggression (Article 437), and violation of the laws and customs of war (Article 438), among others. At this point, the SBU treated the involvement of a Russian special service behind the attack as one hypothesis in its investigation.

The next day, the 13th, the SBU said that one of Russia’s "pseudo-hacker groups" had claimed responsibility, and identified this group as a hacking unit of Russia’s Main Intelligence Directorate of the General Staff (GRU). The SBU explained that the GRU makes the results of its attacks public through this group, and said it would continue to record Russian cyberattacks on civilian infrastructure as war crimes.

On January 4, 2024, the SBU published remarks made by Illia Vitiuk, head of its Cyber Security Department, to Reuters. Vitiuk said the attack had been carried out by Sandworm, a regular unit of Russia’s military intelligence agency, and had been prepared over a period of months. He said the attack had a major impact on civilians, while there had been no serious impact on military communications, and that the SBU had also blocked new attempted attacks that followed the large-scale intrusion.

In its announcement on April 4, 2024, the SBU said it had identified the GRU hackers who carried out the attack, and that after completing forensic examination and notifying the suspects of the charges against them, it would send the investigation materials to the International Criminal Court (ICC) in The Hague. It said accountability would extend not only to the hackers who carried out the attack but also to at least the unit’s commanders and senior intelligence officials.

Kyivstar Group’s 2025 annual report states that the SBU’s criminal proceedings, in which the company is treated as the victim, were still ongoing as of December 31, 2025. The company says it completed its internal investigation, conducted together with outside cybersecurity firms, in 2024.

Compensation for Subscribers

After the network stabilized, Kyivstar, as a gesture of "thanks" to subscribers, made one month’s charges free (or discounted) for some types of contracts. The company said it was under no legal obligation to do so. On December 21, 2023, it announced a donation of 100 million hryvnias to charitable activities in Ukraine.

This measure showed up in its financial results. Kyivstar Group’s annual report estimates the impact of the attack and the compensation on revenue at about $23 million in 2023 and about $46 million in 2024. VEON’s 2023 annual report puts the 2023 impact at 800 million hryvnias in revenue and 900 million hryvnias in EBITDA (earnings before interest, taxes, depreciation, and amortization), and states that the compensation measures ended in the first half of 2024.

2025: Listing in the United States

One year and eight months after the attack, Kyivstar listed on the U.S. stock market. The business combination between VEON and the special-purpose acquisition company (SPAC) Cohen Circle Acquisition Corp. I was completed on August 14, 2025, and ordinary shares of the resulting holding company, Kyivstar Group Ltd., began trading on Nasdaq on August 15, under the ticker "KYIV." At the completion of the combination, VEON held 89.6%.

The company describes itself as the only stock on the U.S. market that lets investors invest solely in a Ukrainian business. Its annual report addresses the 2023 attack in its discussion of risk factors, saying that while it has worked to address the vulnerabilities that led to the attack, it expects to continue to face cyberattacks going forward.

For a way to read wartime reporting on "who carried out the attack" that keeps the announcing party and the timing separate, see our article on the first things to check when reading news about Ukraine. On attacks on the power grid during the war, see also our article on the country where power plants keep coming under attack.