Cyber Incident Victim: Government of Ukraine
Date:
Dec 2024
Location:
Ukraine
Summary
A Russian cyberattack targeted Ukraine's state registries, disrupting access to vital citizen records including births, deaths, marriages, and property ownership. The incident forced temporary suspension of services managed by the Ministry of Justice, with restoration efforts projected to take approximately two weeks while partial functionality was restored within a day. Ukrainian authorities attributed the attack to Russia with the intent to destabilize critical national infrastructure, though other government systems remained unaffected. This incident follows a pattern of reciprocal cyber operations between the two nations during their ongoing conflict, including prior attacks on Ukrainian telecommunications and Russian ministries. Officials plan a comprehensive post-recovery analysis to strengthen defenses against future intrusions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On December 1, 2024, Russia executed a large-scale cyberattack targeting Ukraine’s state registries, as confirmed by Ukrainian Deputy Prime Minister Olha Stefanishyna in a public statement on December 19. The attack disrupted critical government systems managed by Ukraine’s Ministry of Justice, which store essential citizen records including birth, death, marriage, and property ownership data. Stefanishyna characterized the incident as the "largest external cyberattack in recent times" against these registries, forcing authorities to temporarily suspend all operations of the unified and state registry services. The suspension halted administrative processes reliant on these databases, though initial assessments indicated no collateral damage to other state services. Ukrainian officials attributed the attack to Russian actors, asserting its objective was to destabilize the country’s critical infrastructure amid the ongoing conflict.
Service restoration efforts commenced immediately, with Stefanishyna announcing that partial functionality would resume by December 20, one day after the attack’s disclosure. Full recovery of the registry systems was projected to require approximately two weeks. Authorities prioritized reinstating public access to essential services while conducting forensic analysis to identify the attack’s entry points and methodologies. Stefanishyna emphasized plans for a comprehensive post-recovery review to strengthen defenses against future intrusions. The incident occurred against a backdrop of persistent cyber hostilities, including Russia’s December 2023 attack on Ukrainian telecom provider Kyivstar and Ukraine’s June 2024 cyber operations against Russian government ministries. No data theft or permanent system damage was reported in initial statements regarding the registry breach.