What happened

Attackers compromised three Ukrainian regional electricity distributors, including Prykarpattyaoblenergo, and remotely opened substation breakers on 23 December 2015. The coordinated operation used stolen credentials, BlackEnergy-enabled access, KillDisk wiping, corrupted field devices and telephone denial-of-service to obstruct response. Seven 110 kV and 23 35 kV substations were disconnected at the most affected utility, and about 225,000 customers lost electricity for one to six hours before operators restored service manually. It is widely recognised as the first publicly confirmed cyberattack to cause a power-grid outage. This prologue record remains available on the map and as an incident page, while the Incidents by month chart continues to begin on 1 January 2016 as requested.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.