One of the first nights of January, anti-aircraft sirens sound in kyiv because a threat of attack with Russian ballistic missiles has been detected. There is no corner in the Ukrainian capital that escapes the strident sound, but in the reception of a central hotel three newborns sleep soundly in their cuddlies, oblivious to the concern of their parents, who remain with one eye on them and the another in the notices on Telegram about the bombing. The alarm has taken them out of their rooms and led them to take refuge on the ground floor of the accommodation. But they are not only potential victims of the bombs: those three babies, two of them twins, are among the countless victims of an invisible, but very real, conflict that is being waged parallel to the large-scale ground invasion initiated by Russia in 2022: cyberwar.
How do three newborns end up being affected by cyber warfare? It has an easy explanation. They cannot leave the country because a computer attack has prevented their registration in the Civil Registry. These children were born from surrogacy, a practice prohibited in Spain and other countries but legal in Ukraine, a country where thousands of couples turn to have children. Among them, the parents of these three creatures, who traveled from Portugal last December to pick up their children. The stay in kyiv, says Andrea, one of the mothers, is about four weeks, the time it usually takes to get all the relevant documents ready if there are no problems. This time, there has been.
On December 19, Ukraine suffered one of the worst Russian cyberattacks against the country’s critical infrastructure. Deputy Prime Minister Olha Stefanishyna confirmed it that same day: “Today there was the largest external cyber attack in recent times against Ukrainian state records,” Stefanishyna wrote on Facebook. “As a result, the work of the unified and state registries, which are under the jurisdiction of the Ministry of Justice of Ukraine, has been temporarily suspended,” he noted.
The attack was directed against the state records of the Ministry of Justice that contain vital information about citizens, such as births, deaths, marriages and property, but not only. XakNet, the group of hackers that claimed responsibility for the action on Telegram, reports a list of up to 31 databases attacked.
The war in cyberspace between Russia and Ukraine is no small matter. In 2024 alone, the number of cyber attacks in Ukraine increased by almost 70% compared to the previous year – reaching 4,315 incidents, compared to 2,541 in 2023 – according to the press service of State Special Communications.
Most attacks are operated by pro-Russian groups like No Name, according to studies by the Institute for Cyberpeace, a Switzerland-based organization that offers free cybersecurity assistance to vulnerable communities. No Name, for example, attacked last June the subsidiary in Spain that is renewing Leopard tanks for delivery to Ukraine. On the Ukrainian side, the main attacker is the so-called IT Army of Ukraine, a network of hackers coordinated by the Ministry of Digital Transformation that since the beginning of the invasion and until September 2023 has carried out more than 300 cyberattacks against Russian civilian organizations.
Stéphane Douguin, executive director of the Institute for Cyberpeace, maintains that the scope of this parallel war is “massive” and its consequences affect everyone, not just the invaded country and the invader: “If there were no physical war, this other one would lead the news at eight every day,” he emphasizes.
During 2022 and 2023, his organization recorded more than 3,000 attacks, including the one against the main mobile phone company, Kyivstar, which left millions of Ukrainian users without mobile or internet service a year ago. But they also have consequences beyond the borders of the conflict: on February 24, 2022, a hacking coming from Russia interrupted broadband satellite internet access. Specifically, it disabled modems that communicate with Viasat Inc.’s KA-SAT satellite network, which provides internet access to tens of thousands of people in Ukraine and Europe. “Wind turbines across Europe stopped working; above all, the largest German energy company. More than 40,000 subscribers of different internet services were left without service in Germany, France, Hungary, Greece, Italy and Poland,” exemplifies the expert. “They attack other countries for geopolitical reasons, because they share positions or positions of support for Ukraine with ammunition or humanitarian aid.”
For Beatriz and Tereixa’s babies, who do not reveal their real names for privacy reasons, this has meant that they have not been able to be registered. “Officially, they do not exist; Mine was born two weeks ago, but he doesn’t even have a name,” says Beatriz, looking at her son while waiting for the air raid siren to deactivate and they can return to their rooms.
Cybersecurity experts recognize four types of attacks: one is the theft of information to use against the enemy side; another is designed to spread propaganda, which is of increasing concern; The third encompasses disruptive attacks, which seek to prevent systems from working; and the worst of all: those whose purpose is to destroy the system to ensure that it would not be possible to start it again, like the one on December 19, which seriously interrupted the work of the Civil Registry offices for more than two weeks , according to the Ministry of Justice.
Those two weeks have been hellish for Administration officials. Margaret Dzuba works in one of the Registry offices in kyiv and notes that during those days they did not deny service to anyone, but they had to write down the information by hand or in a Word document. “Many of those who came to register births preferred to go home and return when the system was fixed because there is a month’s deadline to do so, but deaths take three days, so they couldn’t wait,” he explains.
Dzuba does not know how many people this ruling may have affected, but he draws on his work to get an idea: “Since December 19, I have registered about 20 newborns per day. As for deaths, statistically we know that we have one birth for every three deaths, so I will have made about 60,” he estimates. Now, you figure you’ll have to work a lot of overtime to log all the late work into the computer system. “And the system works, yes, but very slowly, because we all had to start using it at the same time.” Rada Dashutina, deputy head of the State Office of State Registration of Civil Status Acts, provides more information: “From December 19 to January 4, 35,000 records were collected throughout Ukraine, all of which were entered in the State Register on January 5 and 6,” he tells Morning Express.
One of the worst consequences of this latest attack is the possible permanent loss of essential citizen data, something that the hackers who perpetrated the criminal action boast about, who claimed to have downloaded and deleted both the primary databases of the records such as backup copies stored on servers in Poland.
However, Denis Maliuska, former Minister of Justice of Ukraine, explained to the newspaper Ukrainian Pravda that backups were available and that the data will be recovered soon. Dashutina agrees in this sense: “The company that ensures the operation of this registry has verified all the information and there is no case of disappearance of information or failure to safeguard the information. Therefore, I can assume that the data in the State Registry correspond to what was available on December 19,” he asserts.
But official Margaret Dzuba is not so clear, as she assures that she has verified cases in which information is missing. To prove it, he looks up his father’s file on his own computer: it is all there, except for the nationality and place of birth, whose corresponding boxes appear blank. The official also refers to other cases that she has previously verified. “I don’t know how many people will be affected, but my father is not going to be the only one from Ukraine,” he points out. The solution, in the worst case scenario, is simple: “If a citizen checks in the Diia [la oficina virtual de atención al ciudadano] “If your data is incomplete, you just have to go to the Registry branch closest to your home with your documentation and ask them to update it in the system,” he reassures.
Although Ukrainian records are gradually returning to normal, the State Service for Special Communications and Information Protection of Ukraine has warned that by 2025 they expect attacks to continue and cyberspace to continue to be a focus of a key war for Russia in his attempt to destabilize the situation in Ukraine. “During war, the most valuable information for the enemy is information about the plans of the Ukrainian defense forces, the Government and other organizations that support the army,” they maintain from this organization.
Civilian pirates in military conflicts
Among the hackers responsible for the attacks, the civilian population predominates. In fact, the International Committee of the Red Cross has drawn attention, without specifically mentioning Ukraine or Russia, to the increased involvement of hackers civilians in military conflicts. It is, according to this organization, a “worrying trend” that could undermine the distinction between combatants and civilians during war.
Douguin maintains that it is difficult to measure the economic impact of these phenomena because there are not many resources dedicated to collecting that information. And therefore not enough is being done to stop this war in the background, not even in the context of legislation. “We have not seen any serious international response, but we do see hacker publicly boasting about inflicting harm left and right in the world,” he reproaches. “We also completely lack a deterrence framework that guarantees international cooperation so that the cost of an attack is high enough to make someone who wants to become a cyber soldier think twice.”
A month after the cyberattack on the records, Beatriz and Tereixa are still staying in the hotel in kyiv, going down to the reception with their babies in tow every time the air raid sirens sound. They have already been able to register them, but they have not yet been able to certify the children’s documentation in the notarial registry and they have been informed that, at least, another two weeks await them in Ukraine. “I can’t wait to get home and forget about the sirens and the bombings,” sighs Beatriz.
