Network data from NetBlocks confirm a series of significant disruptions to internet service in Ukraine from Thursday 24 February 2022. Disruptions have subsequently been tracked across much of Ukraine including capital city Kyiv as Russia’s military operation progresses.
On the morning of Thursday 24 February 2022, internet disruptions were registered in Kharkiv, Ukraine’s second largest city:
⚠️ Confirmed: Significant internet disruption registered in #Ukraine-controlled city of #Kharkiv shortly after huge explosions heard; users report loss of fixed-line service on provider Triolan while cellphones continue to work 📉
— NetBlocks (@netblocks) February 24, 2022
Metrics show a loss of connectivity on the Triolan network, corroborating user reports of loss of fixed-line service. The disruption began amid reports of huge explosions in the region as Russia announced a military mobilization, and intensified over the course of the day.
⚠️ Update: #Ukraine's second-largest city #Kharkiv continues to take the brunt of network and telecoms disruptions, leaving many users cut off amid scenes of destruction as Russia targets the region. Kyiv is currently less impacted by outages.
— NetBlocks (@netblocks) February 24, 2022
Also on the morning of 24 February, hours prior to the commencement of Russia’s invasion of Ukraine, the Viasat satellite internet network which serves Ukraine and much of Europe was knocked offline in a targeted cyberattack:
ℹ️ Commercial satellite operator Viasat is investigating a suspected cyberattack that caused a partial outage of its KA-SAT network in Europe.
Network data indicate that the incident began on 24 February ~4 a.m. UTC and is currently ongoing 📉
— NetBlocks (@netblocks) February 28, 2022
Later in the day, a significant internet disruption was registered in the strategic port city of Mariupol, Donetsk. The incident came amid reports of civilian casualties and the loss of telecoms services for many subscribers:
⚠️ Update: A significant internet disruption has been registered in the strategic port city of #Mariupol, Donetsk. The incident comes amid reports of civilian casualties and the loss of telecoms services for many.
— NetBlocks (@netblocks) February 24, 2022
In Kyiv, connectivity started to decline gradually from Thursday morning as civilians fled the capital or sought shelter:
ℹ️ Update: Real-time network data show a significant decline in internet connectivity across #Kyiv, Ukraine since early Thursday, attributed to population exodus and the shuttering of businesses and homes as civilians seek shelter or flee.
— NetBlocks (@netblocks) February 25, 2022
On Saturday morning as the conflict reached Kyiv, a major disruption was registered to backbone internet provider GigaTrans, which supplies connectivity to several other networks.
While connectivity remained available through other routes and the disruption was brief, the incident is understood to have had significant impact to telecommunications infrastructure:
⚠️ Update: Some connectivity has returned to #Ukraine internet backbone provider GigaTrans but service remains intermittent at present. The incident comes amid fighting around capital city #Kyiv. It is unclear if connectivity will be sustained.
— NetBlocks (@netblocks) February 26, 2022
From Monday 28 February, fixed-line internet connectivity and some mobile service has collapsed in Sievierodonetsk, the acting administrative centre of Luhansk Oblast, leaving friends and family cut off. The city has been under intense artillery fire per reports:
⚠️ Update: Internet connectivity has collapsed in #Sievierodonetsk, the acting administrative centre of Luhansk Oblast, #Ukraine; friends and family report no contact with loved ones in recent hours 📉
— NetBlocks (@netblocks) March 1, 2022
NetBlocks metrics shoed progressing disconnections on network operator Kyivstar by 2 March. The operator reports over 500 base stations have been knocked out due to power outages and damage to infrastructure in conflict zones:
⚠️ Update: Internet disruptions are being registered on #Ukraine provider #Kyivstar, who report ~500 base stations disabled due to power and infrastructure damage; outages may limit coverage from #Melitopol and other cities resisting occupation
— NetBlocks (@netblocks) March 2, 2022
By the end of February, the besieged port city of Mariupol was knocked largely offline, amid disconnections attributed to power cuts and a humanitarian crisis caused by heavy combat:
#Mariupol, Ukraine under siege: "We are being completely cut off" report citizens with no electricity, no water and faltering telecoms. Real-time network data show a collapse in connectivity.
— NetBlocks (@netblocks) March 3, 2022
On Thursday evening, 3 March, a major blackout was registered across Sumy Oblast, north-eastern Ukraine, as residents reported massive blasts at the thermal power plant and electrical substation that turned the sky ‘yellow and red’ for miles.
The incident marks the largest single region-wide disruption to telecoms service since the onset of the conflict, and is attributed to the destruction of the region’s electricity production and transmission infrastructure:
⚠️ Confirmed: A telecoms blackout has just been registered across #Sumy Oblast, north-eastern #Ukraine, as residents report massive blasts at the thermal power plant and electrical substation that turned the sky 'yellow and red' for miles.
— NetBlocks (@netblocks) March 3, 2022
From 4 March 2022 NetBlocks tracked a loss of connectivity at the Zaporizhzhia nuclear power plant in southeast Ukraine, affecting fixed-lines and mobile services. The loss of communications was subsequently raised as a point of concern by the International Atomic Energy Agency:
The disconnection of fixed-line internet and some mobile service in and around the #Zaporizhzhia Nuclear Power Plant in #Ukraine is raising concerns over public safety, with radiation levels no longer published and the IAEA unable to monitor.
— NetBlocks (@netblocks) March 7, 2022
On the morning of 9 March, metrics corroborated reports of a power blackout at the mothballed Chernobyl nuclear power plant, which continues to host spent nuclear fuel that requires cooling and monitoring:
⚠️ Confirmed: Real-time network data corroborate reports of a power blackout in the vicinity of #Chernobyl and #Slavutych, #Ukraine. The incident presents a threat to safety at the mothballed Soviet nuclear power plant per authorities #Славутич
— NetBlocks (@netblocks) March 9, 2022
On 9 March 2022, internet provider Triolan was targeted by a cyberattack for a second time, with the first instance having been observed on the morning of 24 February when invasion began. Both events have caused significant losses to connectivity at nation scale:
⚠️ Update: Network provider Triolan in #Ukraine is heavily impacted by a major outage attributed by the company to a cyberattack; incident is the second such tracked, with the first observed on the morning of 24 February when invasion began
— NetBlocks (@netblocks) March 10, 2022
On the night of Thursday 10 March, an attack on the Kharkiv Institute of Physics and Technology, which hosts an ADS neutron source facility, was labelled an “act of nuclear terrorism” by the State Nuclear Regulatory Inspectorate of Ukraine. The incident following attacks at Zaporizhzhia and Chernobyl has heightened concerns that Russia might be intentionally targeting nuclear sites:
⚠️Confirmed: The Kharkiv Institute of Physics and Technology in #Ukraine has fallen offline after an attack by Russia. The targeting of the lab which hosts an ADS neutron source is being called an "act of nuclear terrorism" by authorities.
— NetBlocks (@netblocks) March 11, 2022
On Sunday 13 March, a major internet disruption was registered on the Vinasterisk network which serves Vinnytsia Oblast, western Ukraine. A staff member at the operator reported a massive cyberattack with elements of sabotage and theft via social media, promising more details soon:
— NetBlocks (@netblocks) March 13, 2022
On the morning of Wednesday 16 March, Internet provider Uacity was knocked offline before making a partial recovery. The incident followed Russian shelling targeting the urban district of Shevchenkivskyi, Kyiv, just hundreds of meters from the provider’s listed headquarters:
⚠️ Confirmed: Internet provider Uacity in #Ukraine has been partially knocked offline; disruption follows Russian shelling targeting the residential district of Shevchenkivskyi, Kyiv, just hundreds of meters from its listed headquarters 📉
— NetBlocks (@netblocks) March 16, 2022
Financial problems have also presented challenges for network operators. On Tuesday 15 March, internet provider LocalNet announced that it would have to “lock down subscribers with debt on their account” due to difficulty paying the company’s own bills. The next day, Wednesday, connectivity collapsed and users who had missed a bill payment reported losing access to the internet:
ℹ️ Confirmed: Metrics show a sudden drop in connectivity levels on internet provider LocalNet, #Ukraine. Yesterday, the operator said it would "lock down subscribers with debt on their account" due to difficulty paying its own bills 💳📉
— NetBlocks (@netblocks) March 16, 2022
On Monday 28 March, Ukraine’s national provider Ukrtelecom experienced an extended, nation-scale network disruption, following a major cyberattack. The extent of the incident has progressed over the course of the day, causing an increasing number of subscribers to fall offline, with over a thousand user complaints on the provider’s official Facebook page. On Monday night, the operator said it had mitigated the attack and a restoration of service was observed some 15 hours after the initial disruption.
⚠️ Update: Ukraine's national internet provider Ukrtelecom has confirmed a cyberattack on its core infrastructure.
Real-time network data show an ongoing and intensifying nation-scale disruption to service, which is the most severe registered since the invasion by Russia. https://t.co/syej0wABYO
— NetBlocks (@netblocks) March 28, 2022
The incident follows similar measures by LocalNet. The company said that it had spared active combat zones and occupied territories from disconnection. Telemetry indicate that service was cut off and partially restored after some hours:
ℹ️ Note: Leading internet provider Kyivstar in Ukraine has cut off many of its subscribers with unpaid bills outside active combat areas as of 1 April. The company cites the need for payment to repair war-ravaged infrastructure and pay tax.
— NetBlocks (@netblocks) April 1, 2022
On Friday 8 April, multiple networks in Ukraine suffered a significant decline in connectivity, with operator WNET reporting an emergency situation affecting international connectivity to Europe:
⚠️ Confirmed: Real-time network data show a significant drop in national connectivity impacting multiple internet providers in #Ukraine; operator WNET reports an emergency situation with interconnections to Europe; incident ongoing 📉
— NetBlocks (@netblocks) April 8, 2022
On Wednesday, 13 April, metrics confirmed a collapse of connectivity across Cherkasy Oblast, attributed to the loss of service on McLaut, the region’s largest internet provider. The company is reporting a DDOS attack on its infrastructure, with the incident resolved after several hours:
⚠️ Confirmed: Real-time network data show a collapse of connectivity in #Cherkasy Oblast, #Ukraine, due to the loss of service on McLaut, the region's largest internet provider; the operator reports a DDOS attack on its infrastructure.
— NetBlocks (@netblocks) April 13, 2022
On the early morning of Friday 15 April, attacks knocked out power and internet connectivity around Kyiv Oblast. The disruption has high impact to connectivity Vyshneve, where a transformer supplying power to various districts of Kyiv was damaged.
The attacks are believed to have targeted the Vizar Plant which manufactures Neptune missiles that allegedly sank Russia’s Black Sea flagship Moskva:
The disruption incident had high impact to connectivity #Vyshneve, where a transformer supplying power to various districts of Kyiv was damaged.
— NetBlocks (@netblocks) April 15, 2022
Between 22 and 23 April, internet provider Maxnet in Kharkiv, northeast Ukraine, suffered a series of disruptions that resulted in the total loss of service, which the provider attributed to combat damage to infrastructure:
⚠️ Confirmed: Network data show a collapse in service on #Kharkiv internet provider Maxnet in northeast #Ukraine, with connectivity levels flatlining as the operator reports combat damage to the city's power infrastructure.
— NetBlocks (@netblocks) April 23, 2022
On Saturday 30 April, NetBlocks tracked a near-total internet blackout across the occupied region of Kherson in south Ukraine, affecting multiple Ukrainian providers including Ukrtelecom, Kyivstar, and Volia. Mobile operator Vodafone reported that the incident was “unfortunately not an accident” and at least one anonymous Russian source claimed that Russia was now seeking to deploy its own replacement network:
⚠️ Confirmed: #Kherson in occupied south Ukraine is now in the midst of a near-total internet blackout; real-time network data show the loss of service on multiple providers as one company says incident is "unfortunately not an accident" 📉
— NetBlocks (@netblocks) April 30, 2022
On 1 May, hours after the internet blackout in Kherson, regional provider Skynet (Khersontelecom) partially restored access. However, connectivity on the network has been routed via Russia’s internet instead of Ukrainian telecoms infrastructure and is hence likely now subject to Russian internet regulations, surveillance, and censorship:
See also, traceroute metrics showing that Ukraine's internet provider Skynet (Khersontelecom) is now routing via Russia's Miranda and Rostelecom rather than Ukranian telecom infrastructure following the region's occupation by Russia: pic.twitter.com/oku7pNkaCy
— NetBlocks (@netblocks) May 1, 2022
Metrics show that Khersontelecom’s traffic was rerouted to pass through provider Miranda, which serves Russian-occupied Crimea, and which in turn is supplied by upstream provider Rostelecom in Russia. Authorities responded to the incident and were able to reconnect the Kherson region via Ukrainian infrastructure on Wednesday 4 May.
What’s happening in Ukraine?
Russian leader Vladimir Putin announced military mobilization on the morning of Thursday 24 February 2022 and artillery was fired while as moved into Kharkiv about 25 miles from the Russian border. The security situation deteriorated through subsequent days with Ukrainian authorities advising civilians to get off the streets and seek shelter.
Beside the disruptions to telecommunications infrastructure documented in this report, cyber-attacks have disrupted Ukraine’s defence and banking sectors.
- Ukraine war: Major internet provider suffers cyber-attack – BBC
- Propaganda, fake videos of Ukraine invasion bombard users – AP
- Russia’s Invasion of Ukraine Is Already Taking Down the Internet – VICE
- Internet in Ukraine disrupted as Russian troops advance – Reuters
- Telecoms blackout reported in northeastern Ukraine, first major outage so far – VentureBeat
- Cyber-attacks bring down many Ukraine websites – BBC
- Mobile internet returns to Vodafone subscribers in Luhansk – The Guardian
- Incident of unidentified cause impacts connectivity in Luhansk, Ukraine – La Patilla
- Ukraine Defense Ministry, banks hit by cyberattack amid tensions with Russia – The Hill
- Ukraine Ministry of Defense confirms DDoS attack; state banks loses connectivity – ZDNet
- Ukraine Hit with Cyberattacks as Tensions with Russia Continue – Gizmodo
- Ukraine faces more cyberattacks amid Russian invasion fears – Engadget
- Ukraine’s defence ministry and two banks targeted in cyberattack – Euronews
NetBlocks diffscans, which map the IP address space of a country in real time, show internet connectivity levels and corresponding outages. Purposeful internet outages may have a distinct network pattern used by NetBlocks to determine and attribute the root cause of an outage, a process known as attribution which follows detection and classification stages.
NetBlocks is an internet monitor working at the intersection of digital rights, cyber-security and internet governance. Independent and non-partisan, NetBlocks strives to deliver a fair and inclusive digital future for all.
[ press | contact ] Graphics and visualizations are provided for fair use in unaltered form reflecting the meaning and intent in which they were published, with clear credit and source attribution to NetBlocks. Intellectual property rights are protected including but not limited to key findings, facts and figures, trademarks, copyrights, and original reporting, are held by NetBlocks. Citation and source attribution are required at the point of use.