INCIDENT REPORT · CP-2015-001
Ukraine power grid cyberattack
L4 · CRITICALCONFIRMED
Coordinated remote intrusions at three Ukrainian regional power distribution companies caused unscheduled power outages on 23 December 2015.
- Incident ID
- CP-2015-001
- Incident date
- 23 DEC 2015
- Detection date
- 23 DEC 2015
- Affected countries
- Ukraine
- Plotted location
- Ivano-Frankivsk, Ukraine (Region of the most-affected distribution company (Prykarpattyaoblenergo))
- Threat classification
- Level 4 — CRITICAL
- Classification rationale
- First publicly confirmed cyberattack to cause a power outage; disrupted electricity to ~225,000 customers.
- Attack type
- Infrastructure Compromise
- Nature
- Malicious activity
- Attack vector
- Remote cyber intrusions into distribution company networks after months of reconnaissance; BlackEnergy malware associated with the campaign
- Sectors
- Energy
- Critical infrastructure
- Yes
- Organizations affected
- Three regional electricity distribution companies (oblenergos)
- Operational consequences
- ICS-CERT reported outages affecting approximately 225,000 customers; operators had to move to manual operations and power was restored after several hours.
- Estimated financial impact
- No reliably documented figure
- Attribution (as stated)
- Attributed by the US Department of Justice (October 2020 indictment) to Russian GRU Unit 74455 (Sandworm); Ukraine's SBU also blamed Russia
SOURCE REFERENCES
- [1] Cyber-Attack Against Ukrainian Critical Infrastructure (IR-ALERT-H-16-056-01)CISA (ICS-CERT) · cisa.gov · 25 FEB 2016
- [2] Summary: Justice Department Charges Six Russian GRU OfficersLawfare · lawfaremedia.org
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.