Immediately after the cyber attack on the core of the Kyivstar network, which disabled the entire infrastructure of the largest operator in Ukraine (out of 24.1 million subscribers), Ukrainians mentioned the “national roaming” service, which allows them to switch between operators without changing SIM cards and tariffs. , but it didn't work.
At first it was believed that the “national roaming” service, created just for such cases, did not work due to a hacker attack, which was called the largest in the history of telecom infrastructure not only in Ukraine, but in general in the world. Now it turns out that the service was deliberately limited. The corresponding order, at the direction of the SBU, was issued by the National Center for Operational and Technical Management of Telecommunications Networks (NCU), which belongs to the structure of the State Service for Special Communications and Information Protection of Ukraine (Gosspetsvyaz). The department, which is currently investigating the incident together with the SBU and other law enforcement agencies, explained this forced step by the need to avoid overloading the networks of other operators.
To avoid overloading the networks of other operators, at the request of the SBU, the National Center for Operational and Technical Management of Telecommunications Networks issued an order to temporarily block the national roaming service for Kyivstar subscribers.
according to the official statement of the State Special Communications Service
As a result, during December 12, queues lined up near Vodafone and lifecell stores, almost like for new iPhones near Apple stores at the start of sales, the corresponding eSIM purchase service in monobank< a i=2> ended very quickly (in a matter of minutes, clients issued 1,000 eSim (another 5,000 were in line), after which the service went down, Gorokhovsky said on Telegram). The websites and support of Vodafone (the operator reported that traffic doubled on the website and tripled in the application) and lifecell faced overload and also went down, and their networks are holding up, but in some locations they are working with large interruptions. By the way, the My Vodafone application still does not work, nor does ordering an eSIM on the lifecell website.
As for Kyivstar, it is too early to draw conclusions, because there is almost no specific data about the attack (and this is not surprising, given the circumstances). In an interview with Ukrainian Forbes, company president Alexander Komarov said that it was a super-powerful hacker attack on the core network (core network, responsible for processing traffic between users and services) and infrastructure, which began at 5:26 am with a set of events to distract attention. The attack itself was carefully planned and well organized. Only at 6:30 am the company’s specialists realized the scale and turned off the network to minimize the negative impact. Today, hackers of the Russian group took responsibility for the cyber attack on Kyivstar.
Kyivstar denies reports of encryption of hard drives and assures that the systems where all subscriber information and personal data of subscribers are stored have not been affected and remain completely secure. On the other hand, there is plenty of personal data of Ukrainians on the dark web – for example, from the previously stolen PrivatBank database.
As of 20:00 on December 12, Kyivstar partially resumed the operation of fixed home Internet services. During December 13, the operator plans to restore fixed-line Internet for the remaining households, as well as begin launching mobile communications and Internet services. Provided that everything follows the plan and no new problems arise in the process. Kyivstar mentions a “very high level of uncertainty”, given the scale and complexity of network restoration work (connections are not made automatically, but manually through appropriate verification), including a thorough check for potential hostile software and conditional backdoors left by hackers. Therefore, Kyivstar does not give any guarantees regarding the timing and is in no hurry to assess losses.