Society

Ukrzaliznytsia restores online services after cyberattack: what is known as of March 25

The Ukrzaliznytsia team, together with partners and leading experts, continues to work non-stop to restore online services. A backup infrastructure has already been deployed in a secure environment, and a thorough diagnosis of system backups and the restoration of critical links between different platforms is underway. This was reported by Komersant ukrainskyi with reference to Ukrzaliznytsia.

As of March 25, 2025, the backup infrastructure has been deployed, backups are being diagnosed and complex system connections are being restored. Despite the difficulties, ticket sales at station ticket offices continue in an enhanced mode, and trains run on schedule.

“The backup infrastructure has been deployed in a secure environment, all components have been prepared for restarting critical systems directly from backups, and a thorough diagnosis of backups and identification of all potentially harmful elements is underway. Complex connections between different systems are being restored,” the statement said.

According to Ukrzaliznytsia, online ticket sales are planned to be restored as soon as possible, and in the meantime, station ticket offices are operating in an enhanced mode.

To restore services as soon as possible, Ukrzaliznytsia is actively cooperating with:

• The Cyber Department of the Security Service of Ukraine,
• The State Center for Cyber Defense,
• Government response team CERT-UA,
• Kyivstar IT team, which has experience in recovering from a large-scale cyberattack,
• ukrainian and international experts.

This partnership allows us to accelerate the process of returning all digital services to a stable operating mode.

How does ticketing work during recovery?

While online services are being restored, tickets are sold through ticket offices at railway stations. For passengers’ comfort, the ticket office hours have been extended. For example, in Kyiv, instead of the usual 8 ticket offices, there are 18. All trains are running on schedule, and waiting in lines has been reduced to 10-15 minutes.

Ticket sales at ticket offices are available only for the next two days. This decision was made to ensure a fair distribution of seats and to give priority to military personnel and other passengers with an urgent need to travel.

How do I return tickets?

Train tickets for the current day can be refunded according to the following algorithm:

• One hour before the train departure, send an email to [email protected].
• Attach a scanned copy or a clear photo of the ticket.
• Provide your contact phone number.
• Ukrzaliznytsia will process the request within three days after the system is fully restored.

What is known about the failure

According to the company, Russia launched a targeted cyberattack on the IT infrastructure of Ukrzaliznytsia. The goal is to provoke delays in train traffic and destabilize the carrier’s operations. The statement noted that the attack was “systemic, non-trivial and multi-level,” making it difficult to neutralize.

Despite the complexity of the situation, Ukrzaliznytsia activated backup protocols and restored the main systems.

“The enemy has not succeeded: train traffic is stable, they run smoothly without delays and all operational processes are adjusted in a backup format. The railroad continues to move despite physical attacks on the infrastructure, and even the most vile cyberattacks cannot stop it,” the statement said.

However, before the full launch of online services, experts test them for vulnerability to avoid repeated attacks. For now, online ticket sales remain blocked, and the company will operate offline until March 24.

Ukrzaliznytsia has engaged the Cyber Department of the Security Service of Ukraine to resolve the issue as soon as possible. Joint efforts are underway to analyze the attack and strengthen system security.