What happened

Custom malware known as Industroyer (also CrashOverride) opened circuit breakers at the Pivnichna 330 kV transmission substation outside Kyiv, cutting power to a portion of the capital — roughly one-fifth of the city by some accounts — for about an hour before operators restored supply manually. It was the first known malware purpose-built to disrupt electric grid operations, speaking industrial protocols including IEC-101, IEC-104 and IEC-61850 directly to substation equipment. ESET called it the biggest threat to industrial control systems since Stuxnet. The marker is placed at the substation; coordinates are approximate.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.