Ukraine’s Digital Defenses Must Protect Access, Not Just Data

Two accounts from Kyiv capture the uneven results of Ukraine’s digital defenses. On September 25, 2026, telecommunications operator Datagroup reported that a Russian attack had damaged its data center, but that services continued from backup sites. The following day, Cosmonova announced that its own heavily damaged facility would cease operating, with work continuing to relocate and restore services. Broadcasters reported disrupted signals. Physical destruction had produced sharply different operational outcomes. (en.interfax.com.ua)

That contrast matters more than any blanket claim that Ukraine’s digital infrastructure is either secure or approaching collapse. A data center houses the computers and networking equipment that run services; losing the building need not mean losing the service. Datagroup’s account demonstrates that possibility, although it is an operator’s statement rather than an independently audited continuity record. Cosmonova’s account shows why preserved data and successful service delivery must be assessed separately. (en.interfax.com.ua)

I think Ukraine has demonstrated a substantial capacity to keep national digital operations alive. But reliable access during sustained attacks remains a harder, inadequately demonstrated achievement. The right priority is to protect the entire route between a functioning application and its user, rather than treating overseas computing as the finish line.

The latest damage reports require careful attribution. Ukraine’s digital ministry said the September 23 attack disrupted internet service for roughly 100,000 households in Kyiv and the surrounding region, according to Ukrainska Pravda. MiroHost’s founder subsequently said a facility housing its equipment had been destroyed and could not give a restoration timetable. These are identified accounts of damage and consequences, but they do not provide an independent engineering assessment or complete recovery logs. The September 18 report that Russia had struck De Novo was weaker still: Data Center Dynamics explicitly attributed that allegation to Russian authorities. It should not be treated as verified damage. (pravda.com.ua⁴)

There is firmer independent evidence for the wider pathway from physical attack to civilian disruption. United Nations monitors, drawing on site visits and interviews, documented nine waves of attacks on electricity infrastructure between March 22 and August 31, 2024. Facilities across 20 regions were struck. Some cities subsequently experienced at least 12 hours of blackouts daily; communications disappeared during outages, and health services were compromised. Russia does not have to destroy a database to interrupt a service that depends on it. That last point is my inference from the documented loss of electricity and communications. (ukraine.ohchr.org)

The mechanism becomes clearer in Kyivstar’s operational explanations. In July 2024, the telecommunications company said its mobile-site batteries needed four to six hours to recharge, while fixed-network backup units needed eight. Repeated outages could prevent complete charging. It also explained that a customer could have electricity but no internet because equipment serving neighboring buildings had lost power. A working computer at each end therefore did not guarantee a working connection between them. (kyivstar.ua⁸)

Those historical limits should not be mistaken for today’s specifications. Kyivstar now advertises up to ten hours of mobile-network autonomy and twelve for home internet. But its published qualifications include outage frequency, battery charge and network load, alongside exclusions for damaged, inaccessible or technically unsuitable sites. These investments are real defenses. The qualification is that maximum endurance is conditional, rather than a promise that every user remains connected through successive blackouts. (kyivstar.ua)

Banking supplies an important check against excessive pessimism. Ukrainian authorities reported that 98.5% of branches in the POWER BANKING network remained operational during prolonged electricity disruptions following September 2024 attacks. This designated network, designed to operate through power cuts, covered about 55% of all branches. Separately, the National Bank recorded approximately 8.185 billion cashless card transactions during 2024; 91.8% of all transactions using Ukrainian-issued cards occurred domestically. These figures establish substantial functioning services, not simply surviving backups. (bank.gov.ua)

The case for confidence is straightforward: essential services have continued operating under extraordinary pressure, and concentrating on every local interruption can obscure that achievement. I accept that argument against predictions of national digital collapse. It does less to establish timely access. Branch availability does not measure completed customer requests, while annual transactions cannot distinguish uninterrupted service from payments deferred until the network returns. Neither dataset establishes how long particular communities were excluded after individual strikes. (bank.gov.ua)

Cloud migration also protects more than archives. PrivatBank reported moving over 270 critical applications and 3,500 servers into the cloud in under 45 days in 2022. Ukraine’s digital ministry reported that approximately 100 state registers and critical databases had migrated to Amazon Web Services by December that year. Microsoft separately credited European hosting with helping sustain government operations. These participant accounts support a clear mechanism: moving operating systems away from domestic facilities reduces their exposure to physical destruction there. (privatbank.ua¹²)

Still, migration time is different from failover time (the time needed to switch operations to an alternative system). An unusually useful De Novo incident report shows why recovery needs several clocks. On April 26, 2025, an equipment defect during maintenance caused total power loss at 8:03 a.m. Electricity returned at 8:17, the cloud was fully restored around 9:45, and the incident’s consequences were resolved around 1 p.m. This was an operator-reported equipment failure, not a Russian strike. Its significance is the gap between electrical recovery and usable systems: fourteen minutes without power created hours of restoration work. (denovo.ua¹⁵)

I would not extrapolate banking results into a clean bill of health for hospitals or industrial operations. The UN evidence establishes broader harm to health services, but does not isolate hospital-record outages or supply institution-by-institution recovery times. The government’s register-migration account establishes deployment, not an independent audit of access during attacks. I found no representative, strike-linked record sufficient to certify timely recovery across payments, hospital workflows, public records and industrial services. That missing evidence limits both reassurance and claims of comprehensive failure. (ukraine.ohchr.org)

European hosting remains a sound defense despite the risks facing host countries. On September 18, French President Emmanuel Macron said he had requested stronger protection of critical infrastructure against drones and cyberattacks amid an intensifying Russian threat. Microsoft had already documented Russian intrusion attempts against 128 organizations in 42 countries outside Ukraine in its June 2022 assessment, including technology and infrastructure suppliers. Neither source establishes that hosting Ukrainian workloads caused those attacks. I see grounds for stronger provider security and recovery arrangements, not for returning concentrated computing capacity to the immediate strike zone. (apnews.com)

The practical standard I would apply is completed essential work during disruption: whether a payment goes through, a clinician gets the needed record, or an institution can finish a time-sensitive task. Tests should include disconnected users, abandoned attempts and effective offline alternatives, alongside battery depletion and restoration times. A service should earn a resilience claim by meeting an explicit deadline under attack conditions. Keeping national systems alive is an indispensable achievement; protecting civilians requires measuring what those systems actually let them do.