Kyivstar

Profile narrative

Kyivstar is a telecommunications company that provides mobile voice and data services to customers across Ukraine. As the country's largest mobile operator, it offers nationwide coverage for personal and business communications. The company's core portfolio includes traditional mobile telephony, mobile internet access, and related value‑added services. It also supports critical national infrastructure, such as the air raid alert system, by maintaining connectivity that enables timely warnings. Kyivstar's services are used by millions of subscribers who rely on the network for everyday communication and emergency notifications. The operator operates from its headquarters located in Ukraine.

The operator's scale is highlighted by its status as Ukraine's largest mobile provider, serving a subscriber base that numbers in the millions. This extensive reach gives Kyivstar a significant footprint in the Ukrainian telecommunications market. The company's network infrastructure underpins a wide range of civilian activities, from personal calls to business transactions and banking operations. During the December 2023 cyberattack, the disruption affected services for millions of users and caused partial destruction of IT systems. The attack also compromised critical air raid alert systems in several regions, underscoring the operator's role in public safety. Restoration efforts brought partial service back within a day, while full recovery continued amid ongoing security concerns.

Kyivstar's distinguishing attributes stem from its position as the leading mobile operator and its involvement in national security communications. The company has faced notable cyber incidents that reveal both its vulnerabilities and its importance to the country's resilience. In June 2017, Kyivstar was impacted by a supply‑chain attack involving the M.E.Doc accounting software, which delivered NotPetya wiper malware, PsCrypt and XData ransomware variants, and the Chthonic backdoor. That incident demonstrated how a trusted software update could be leveraged to spread destructive code across multiple sectors. The December 2023 attack was described as destructive rather than financially motivated, aligning with wartime cyber hostilities and prompting investigation by Ukrainian intelligence into possible Russian state involvement. A Russian hacktivist group claimed responsibility for the 2023 event, although no evidence was presented to substantiate the claim. These episodes highlight Kyivstar's dual role as a commercial service provider and a component of Ukraine's critical information infrastructure.

Incidents

2 incidents linked to this organisation.