Ukrainian Government Websites Hacked: Citizens' Data, Russian Involvement and International Reaction

The "message" from hackers published on the hacked websites was clearly provocative in nature, aimed at stoking conflict between Ukraine and Poland.

Overnight on January 14, hackers carried out a mass attack on Ukrainian government websites. The targets included the Cabinet of Ministers website, several ministries and even the Diia website. The SBU says there was no leak of personal data.

The EU, NATO and the US condemned the attack on Ukrainian government websites and said they were ready to help.

Since early Friday morning, the websites of the Cabinet of Ministers, the Foreign Ministry, the State Emergency Service, the Ministry of Education and Science, the Ministry of Sports, the Ministry of Energy, the Ministry of Agrarian Policy, the Ministry for Veterans Affairs and the State Treasury website have not been working.

On the website of the Foreign Ministry and some others, a message of a provocative nature could be seen, appealing to painful points in Ukrainian-Polish history and clearly posted with the aim of provoking conflict between the countries:

"Ukrainian! All your personal data has been uploaded to the common network. All data on the computer is being destroyed and cannot be restored. All information about you has become public. Be afraid and expect the worst. This is for your past, present and future. For Volhynia, for the OUN UPA, for Galicia, for Polissia and for the historical lands."

The message was published in Ukrainian, Russian and Polish. It was later removed, and the websites simply stopped opening. However, the Polish version contains lexical constructions atypical for the language, which confirms the use of an electronic translator from Russian.

Global attack

The Foreign Ministry was among the first to confirm the hacker attack.

"As a result of a massive hacker attack, the websites of the Foreign Ministry and a number of other government bodies are temporarily down. Our specialists are already working to restore the operation of the IT systems. We apologize for any possible inconvenience," said Foreign Ministry spokesman Oleg Nikolenko.

The Ministry of Education also reported a "global attack overnight from January 13 to 14."

The ministry urged people to use other web resources, including the official pages of ministries on social media.

The Ministry of Digital Transformation assured that Diia is a safe product, and the portal has now been shut down, as have a number of other government websites, to prevent the attack from spreading to other resources.

Earlier, Minister of Digital Transformation Mykhailo Fedorov, who is responsible for developing and implementing Diia, assured that all Ukrainians' personal data is securely protected, since it is not stored on the portal but in separate registries, from which the resource only displays and generates documents.

No data leak occurred

The Security Service of Ukraine reported a hacker attack on a number of government websites and assured that no data leak had occurred.

"A provocative message was posted on the home pages of these websites. However, the content of the websites was not changed, and, according to available information, no leak of personal data occurred," the agency said in a statement.

The SBU added that the operation of other government websites had been suspended. This was done to prevent attacks on other resources and to localize the technical problem.

The SBU, the Cyber Police and the State Special Communications Service are investigating the incident and collecting digital evidence.

Most of the affected government resources have already been restored, the SBU added.

The State Special Communications Service stressed that the Diia mobile app is operating normally.

"Another provocation by Russia"

The Embassy of Ukraine in Japan commented on the messages that appeared on government websites. In its view, the message is intended to mislead.

"It is being made to look as if it is coming from Poland. In fact, there is no doubt that this is another provocation by Russia," the embassy's statement said.

"If you see such or other provocative messages on other government resources, keep in mind that a war is being waged against Ukraine," the embassy added.

According to the research of the Center for Strategic Communications and Information Security, the initial data give grounds to believe that the attack was carried out by the Russian Federation.  

"Ukrainian internet resources have been attacked since the beginning of Russia's military aggression not for the first time, and not even for the second time. Some cyberattacks were so massive that they entered world textbooks for cybersecurity specialists. The goal of such attacks is to destabilize the internal situation in the country, as well as to sow chaos and despair in society," the Center said.

"We assume that this is related to Russia's recent defeat in negotiations on the future of Ukraine's cooperation with NATO," the agency added.

Shawn Townsend, spokesperson for the Ukrainian Cyber Alliance, notes that a message about the website hack appeared in Russian media at night, two hours after the incident itself.

"In the EXIF data of the picture, the coordinates point to a parking lot near the School of Economics in Warsaw, but I believe all of this was done deliberately to discredit Ukraine and Poland," he wrote on Facebook.

International reaction

The United States threatened Russia with a new package of sanctions if its involvement in the cyberattack is confirmed, which Washington sees as a resumption of aggression against Ukraine.

Julian Smith
Permanent Representative of the United States to NATO

If the evidence of Russian involvement in cyberattacks on Ukraine's government websites is unequivocal, this could lead to the launch of new sanctions against Russia. Evidence that Russia carried out the cyberattacks will certainly be classified as an example of the resumption of aggression against Ukraine. We are watching everything Russia is planning to do with regard to Ukraine. We are prepared for some efforts to destabilize Ukraine from within.

Josep Borrell, the EU High Representative for Foreign Affairs, condemned the attacks on Ukrainian websites and said the European Union is ready to help Ukraine defend itself.

"We plan to mobilize all our resources to help Ukraine cope with this attack. Unfortunately, we knew that this could happen," he said at a meeting of EU foreign ministers in Brest, France.

NATO Secretary General Jens Stoltenberg responded to the cyberattack, declaring "strong condemnation" and announcing the signing of an agreement between NATO and Ukraine to strengthen cyber cooperation.

Jens Stoltenberg
NATO Secretary General

I strongly condemn the cyberattacks on the Ukrainian government. In the coming days, NATO and Ukraine will sign an agreement to strengthen cyber cooperation, including Ukraine's access to the Alliance's platform for sharing information about malicious software. NATO has been working closely with Ukraine for many years, helping to strengthen its cyber defenses... NATO cyber experts in Brussels are exchanging information with Ukrainian colleagues about current malicious cyber activity, and are also supporting Ukrainian authorities on the ground.

The Polish Foreign Ministry also condemned the cyberattack.

Łukasz Jasina
Spokesperson for the Polish Foreign Ministry  

We are concerned about information regarding a cyberattack on Ukrainian government websites, including the Foreign Ministry website. We strongly condemn any activity that spreads disinformation and disrupts the functioning of state institutions.

Estonian Prime Minister Kaja Kallas condemned the cyberattack on Ukrainian government institutions' websites and said Estonia would help Ukraine in the current situation.

Kaja Kallas
Prime Minister of Estonia

We strongly condemn the recent cyberattacks against Ukraine, which are of particular concern in the current security situation. Those behind them must be held accountable. Estonia is helping Ukraine in connection with this attack and, in general, with the aim of strengthening its cybersecurity capabilities.

At the same time, Swedish Foreign Minister Ann Linde expressed support for Ukraine and called for a tough stance toward Russia. "If attacks against Ukraine occur, we will be very tough and resolute in our response," she said before the meeting of EU ministers.

Swedish Foreign Minister Ann Linde also expressed support for Ukraine and called for a tough stance toward Russia. "If attacks against Ukraine occur, we will be very tough and resolute in our response," she said before the meeting of EU ministers.