The 2015 Ukraine Power Grid Attack: A Blackout Caused by Hackers

On 23 December 2015, parts of western Ukraine lost electricity in the middle of winter. The cause was not a storm or a technical failure. Attackers had taken control of systems at regional power distribution companies and switched off power to customers. It is widely regarded as the first confirmed case of a cyberattack causing a power outage.

What happened

Three regional distribution companies were affected. The most commonly cited figure is that around 225,000 customers lost power, for periods ranging from one to six hours. The operators were able to restore supply by switching to manual control, driving to substations and operating equipment by hand. That ability to work without the computers is the main reason the outage was not longer.

The attackers did more than turn off breakers. They also overwrote firmware on some devices that convert serial communications to Ethernet, which made remote restoration impossible. They launched a flood of calls against the companies' call centres to prevent customers reporting the outage and used a data-wiping tool to disrupt operators' computers.

How the attackers got in

Investigations, including those by the US-based SANS Institute and the Electricity Information Sharing and Analysis Center, described a careful and patient operation that probably started months earlier:

1. Phishing. Staff received emails with Microsoft Office attachments that asked them to enable macros, which installed a malware family known as BlackEnergy.
2. Credential theft. The attackers collected usernames and passwords, including those for VPN access into the control networks.
3. Reconnaissance. They spent time learning how the systems worked, including how operators used the human-machine interfaces.
4. Coordinated action. On the day, they logged in remotely and used the operators' own software to open breakers.

Who was behind it

Ukrainian authorities blamed Russian actors. Security companies linked the activity to a group often called Sandworm, and in 2020 the US Department of Justice charged officers of a Russian military intelligence unit in connection with this and other attacks. Russia has denied involvement. As in many such cases, official attributions come from governments, so they are best described as attributions rather than court findings.

A repeat in 2016

In December 2016 a second attack hit part of the grid serving Kyiv, using a more automated tool that researchers named Industroyer or CrashOverride. It caused a shorter outage and showed that the attackers were improving their methods. Both incidents became case studies for utilities everywhere.

Why it still matters

The incident proved that the connection between corporate networks and operational systems is a crucial boundary. The attackers did not need to break complex industrial protocols at first; they needed ordinary logins and an office document that got opened. The defence lay partly in the ability to run the grid manually, a reminder that resilience depends on practising how to work when the technology is gone.

What defenders learned

Reports after the attack stressed several practical points that translate well beyond energy companies. First, the networks that run operations should be separated from office networks, with strict control over what passes between them. Second, remote access into sensitive systems should require more than a password; two-factor authentication on the VPN would have made stolen credentials far less useful. Third, macros in office documents are a favourite route in, and disabling them by default for documents that come from outside removes an easy option.

The incident also highlighted the importance of logging and monitoring. The attackers were inside for months, and unusual logins to the control networks should have been visible to someone watching. Organisations that kept good records could reconstruct what had happened, which in turn helped them improve their defences and warn others.

Finally, the Ukrainian operators' ability to switch to manual control proved that it is worth keeping and practising the old way of doing a critical job. A business that depends entirely on one website or one online system should do the same kind of thinking, even if the stakes are smaller.

Why timing and patience mattered

One striking feature of the operation was its patience. The first malicious emails were reportedly sent months before the blackout, and the attackers waited until they understood the environment well enough to act on several sites at the same moment. That kind of preparation is typical of well-resourced groups, but the underlying habit, slowly collecting access before acting, is also used by ordinary criminals who plant a hidden login on a website and return weeks later. Checking for unknown admin users and unfamiliar files is how you catch it.

The practical lesson for site owners

The same three weak points show up on website infrastructure: phishing that steals a login, remote access that needs only a password, and no easy way to cope if the system is lost. Protect every remote login, including your hosting control panel, SFTP and email, with strong unique passwords and two-factor authentication where available. Separate important systems from everyday ones and know how you would run the business if the website were unreachable for a day.

Keep backups off the server, and read our security overview for the protections that come with our plans. If you manage a server yourself, a VPS lets you restrict logins to specific addresses and set up key-based access.