Ukrainian power grid attacks (2015 and 2016)
The first publicly confirmed power outages caused by a cyberattack, attributed to Russian military intelligence, which showed that a computer intrusion can produce large-scale physical effects.
On 23 December 2015, three electricity distributors in western Ukraine lost control of their substations. Attackers, who had entered months earlier through phishing emails carrying BlackEnergy malware, took over the supervisory interfaces, opened breakers remotely, wiped workstations and flooded call centers. About 225,000 customers lost power for several hours. On 17 December 2016, a second attack hit a transmission substation near Kyiv with a more advanced tool, Industroyer, able to speak the grid's industrial protocols directly; the outage lasted about an hour. Both operations were attributed to the Sandworm group, a unit of Russian military intelligence, in a country in armed conflict with Russia since 2014. For insurance, the episode is foundational in three ways. It proved that cyber risk is not only intangible: it can stop a physical infrastructure. It showed that recovery depends on manual procedures, Ukrainian operators having restored power by switching to local control. And it raised the question that war and infrastructure clauses later tried to settle: does a state attack on a power grid, in an undeclared armed conflict, fall under the war exclusion?
An underwriter models a scenario of a one-day regional outage caused by an intrusion at an electricity distributor. The underwriter reuses the 2015 sequence, initial access months earlier, breakers opened, workstations wiped, to test whether the property and cyber policies respond, and which one.
BlackEnergy, Industroyer, CrashOverride, Ukraine grid attack
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.