Cyberattack hits Ukrainian state railway, disrupting online ticket sales

KYIV, Ukraine — Kyiv’s central railway station was unusually crowded on Monday morning, with dozens of people waiting in long lines to buy tickets for travel within Ukraine and abroad.

The delays followed a large-scale cyberattack targeting Ukrzaliznytsia, the country’s state-owned railway operator. The attack disrupted online services, including the mobile app used for ticket purchases, but did not affect train schedules, the company said in a statement.

"The railway continues to operate despite physical attacks on its infrastructure and cannot be stopped even by the most insidious cyberattacks," Ukrzaliznytsia added.

The railway operator is investigating the incident with the help of Ukraine’s security services, but it has not yet disclosed technical details.

“This attack was systematic, complex, and multi-layered,” the company said, adding that before fully restoring the affected systems from backups, cybersecurity specialists must first test them for potential vulnerabilities.

The railway has been a lifeline for millions of Ukrainians since Russia invaded the country. With all Ukrainian airports shut down and air traffic suspended, Ukrzaliznytsia became one of the most popular means of transport for both domestic and international travel.

The railway is also used to evacuate injured civilians and soldiers, deliver humanitarian aid, food and medical supplies to war-affected regions, as well as export grain, metals and other goods to Europe.

Passengers line up for tickets at Kyiv's central rail station on March 24, 2025. Image: Daryna Antoniuk / Recorded Future News

Ukrzaliznytsia’s infrastructure is frequently targeted by Russian drones and missiles, and it has also faced cyberattacks. Following the latest attack, the company doubled the number of ticket windows and staff at several stations, including Kyiv, to accommodate passengers.

Some travelers at Kyiv’s central railway station, speaking to Recorded Future News, expressed frustration. They said they had previously purchased tickets easily via the Ukrzaliznytsia mobile app but now had to visit the station and wait in line.

Andrii, a local international relations student who declined to give his surname, said he had planned to travel from Kyiv to his hometown of Lviv on Monday evening for a friend's birthday but now expected delays because he couldn’t buy tickets online.

Ukrainian state cyber agencies, which are helping to investigate the incident, have not publicly commented on the attack or attributed it to a specific hacker group.

Previous incidents involving Ukraine’s critical infrastructure have been attributed to Russian state hackers.

In 2023, the country’s largest telecommunication operator, Kyivstar, suffered one of the largest Russia-linked cyberattacks, disrupting services for several days. Ukraine also faced a major cyberattack on its state registers earlier this year, with suspected Russian threat actors targeting several databases containing sensitive official records, such as biometric data, property ownership, and business and tax records.

In January 2024, hackers disrupted the operation of a Ukrainian data center serving several state-owned companies, including Ukrzaliznytsia as well as the national postal service provider and a large energy company.