Scourge · December 23 2015

Winter Darkness in Ukraine

Chronicle

On 23 December 2015 attackers took remote control of the systems of three Ukrainian regional power distribution companies and opened substation breakers. About 225,000 customers lost power for several hours in the middle of winter. The attackers also wiped systems with KillDisk and flooded call centres so that people could not report the outages. It was the first confirmed cyberattack to take down a power grid; the US government later attributed it to Russian state actors (Sandworm).

Lesson learned

It showed that attacks on critical infrastructure strike people directly, and that the ability to fall back to manual control, as Ukrainian engineers did, is an essential part of defence.

Prayer of reparation

For the families left in the cold and dark, and for the engineers who restored power by hand, substation by substation, we ask warmth, light and gratitude. Grant us the wisdom to protect what everyone's life depends on. Amen.

How it is remembered

Remembered by separating operational networks from office ones, requiring MFA for remote access to control systems and training staff to run the grid even without computers.