History and stories
The first attack to turn off a power grid
Control room operators watched their own cursors move across the screen, switching off substations one by one.
1 min readStory
The short version
Two days before Christmas 2015, attackers switched off power to about 230,000 people in Ukraine. It started months earlier with an email.
The story
On December 23, 2015, power went out for about 230,000 people in western Ukraine, for between one and six hours. It was the first publicly confirmed cyberattack to cause a power outage.
The attackers had been inside the power companies for months. They got in through emails with infected Microsoft Office attachments, sent to staff. Once inside, they collected passwords, including the ones used for remote access to the systems that control the grid.
On the day, they signed in remotely and opened circuit breakers, switching off substations. Operators saw it happening on their screens and could not stop it. The attackers also wiped computers, disabled backup power in the control centers and flooded customer phone lines so people could not report the outage.
Engineers restored power by driving to substations and switching them back on by hand. The attack was attributed to a Russian group known as Sandworm.
Why it mattered
As the first confirmed cyberattack to cause a power outage, it showed that the systems controlling a grid can be switched off remotely by attackers who started with an ordinary email. Power came back only because engineers could still run the equipment by hand.
The lesson today
Every step used ordinary tools: phishing email, stolen passwords and remote access that let anyone with the password in. Remote access to important systems needs more than a password, and someone needs to be watching who is signing in and when.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.