ALT-36 · Analysis · 23 Oct 2026
Ukraine, December 2015: the first blackout caused by hackers
Attackers took remote control of three Ukrainian power distribution companies and switched off substations, leaving about 225,000 customers without power. How a coordinated grid attack was staged.
- 2015Spear-phishing emails deliver BlackEnergy 3 malware to the utilities.
- 23 Dec 2015Coordinated outages at three distribution companies within about 30 minutes.
- Feb 2016US ICS-CERT publishes its alert on the attack.
- Customers who lost power
- ~225,000CISA (ICS-CERT) alert IR-ALERT-H-16-056-01
- Distribution companies hit in coordination
- 3CISA (ICS-CERT)
How it was done
- Months of reconnaissance after phishing, then theft of credentials to VPNs and control systems.
- Operators watched cursors move on their own screens as breakers were opened through remote access.
- KillDisk erased workstations; serial-to-Ethernet converters got malicious firmware; uninterruptible power supplies were disrupted.
- A telephone flood on call centres kept customers from reporting outages.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- The attack used legitimate tools: remote access to a control system is itself the weapon.
- Manual fallback saved the day: crews restored power by operating substations by hand.
- Destroying the means of recovery was part of the plan; plan recovery accordingly.
What to do
- Require multi-factor authentication for every remote path into control networks.
- Keep and rehearse manual operating procedures.
- Keep firmware images and spares for field devices offline.
Sources
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-36 — Ukraine, December 2015: the first blackout caused by hackers. 23 Oct 2026. altumptic.com/research/ukraine-grid-2015