On January 16, the Ministry of Digital Transformation said that the cyberattack on Ukraine was orchestrated by Russia and aimed at intimidating the country's citizens and destabilizing the situation inside the country.
“As of today, it can be said that all the evidence indicates that Russia is behind the cyberattack. Moscow continues to wage a hybrid war and is actively building up its forces in the information and cyber space. Most often, Russia's cyber forces operate against the US and Ukraine, trying to use technology to shake the political situation. The latest cyberattack is one of the manifestations of Russia's hybrid war against Ukraine, which has been ongoing since 2014,” the ministry said in its statement.
The ministry noted that Russia's goal is not only to intimidate society, but also to destabilize the situation in Ukraine by halting the work of the public sector and undermining Ukrainians' trust in the authorities.
“They can achieve this by spreading fakes into the information space about vulnerabilities in critical information infrastructure and about the ‘leak’ of Ukrainians’ personal data. Therefore, we urge Ukrainians not to panic. All personal data is under reliable protection in state registries,” the Ministry of Digital Transformation added.
It is noted that the State Special Communications Service, together with the SBU and the Cyber Police, continues to investigate the cyberattack on government websites.
The ministry said that Diia does not store Ukrainians’ personal data, and that all of it is kept “in the relevant registries, which are reliably protected.” The app serves only as a “bridge” between the information in state registries and the user.
What was said in the US
The US President's National Security Adviser said that if Russia's involvement in the cyberattack on Ukraine is confirmed and such attacks continue, the US and its allies will work on countermeasures.
Jake Sullivan
National Security Adviser to the US PresidentIf it turns out that Russia is carrying out cyberattacks against Ukraine, and if this continues in the future, we will work with our allies on an appropriate response.
According to him, the Biden Administration has for several months warned that cyberattacks could be part of “Russia's large-scale efforts to escalate the situation in Ukraine,” and the US is working with the Ukrainian government to strengthen protection.
Sullivan said: “This is part of their playbook. They have done this in the past in other contexts.”
The adviser noted that the US has not yet identified who organized the cyberattack on Ukraine, but added that he would “not be in the least surprised” if Russia turned out to be the organizer.
He warned that Russia would face “serious economic consequences” from the US and Western allies if it invades Ukraine. If Russia does take military action, the United States will “take measures that will damage their economy, strike at their strategic position in Europe, and strengthen NATO solidarity.”
Transport bureau's resources affected
As a result of the cyberattack on Friday, a number of external information resources of the Motor Transport Insurance Bureau of Ukraine (MTSBU) were lost, but the registry containing the personal data of millions of Ukrainian car owners was not damaged.
“It has been established that, as a result of the cyberattack, a number of external information resources of MTSBU were lost. The registry containing the personal data of millions of Ukrainian car owners has not been damaged. It will resume operations in the near future, for which MTSBU specialists are deploying a new ‘clean’ information infrastructure,” the ministry said in its statement.
The State Special Communications Service said it is premature to link isolated cases of malware disguised as ‘ransomware’, which Microsoft reported earlier, to the main cyberattack.
“A team of CERT-UA specialists is studying information from Microsoft's Threat Analysis Center (MSTIC) on attackers using malicious software disguised as ‘encryption’ software, but destructive in nature, to attack certain government information resources. Isolated instances of activity of such software were indeed recorded during Friday, but it is premature to link them to the main cyberattack. The results of the investigation will be announced immediately after the analysis of the relevant technical data is completed,” the State Special Communications Service said.