What happened

Attackers who had compromised utility networks roughly eight months earlier via a BlackEnergy 3 malware attachment used stolen credentials to remotely switch off substation breakers at three regional distributors — Kyivoblenergo, Prykarpattyaoblenergo and Chernivtsioblenergo — cutting power to about 230,000 customers in western Ukraine for one to six hours. The intrusion also deployed the KillDisk wiper against control and non-control systems and flooded utility call centers with automated calls to delay outage reports and hamper recovery. It is the first publicly acknowledged cyberattack to cause a power outage, and the direct predecessor to the 2016 Kyiv Industroyer attack recorded separately on this map. The marker is placed at Prykarpattyaoblenergo, one of the three affected distributors.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.