Russia Squeezes Ukraine’s Internet From Kyiv to Poland

Russian strikes on Kyiv data centers cut internet to about 100,000 households on September 23. A drone on September 25 then hit an office building that housed Datagroup, killing four people in the car park. Datagroup said none of its own staff were hurt and that its services kept running from backup sites.

The same night the first wave began, a fire broke out at a Starlink ground station in Wola Krobowska, Poland, a site that carries traffic toward Ukraine. Polish prosecutors later treated that blaze as arson aimed at a satellite gateway, not as a freak electrical fault.

Three Days of Hits on Kyiv’s Server Rooms

Ukraine’s Ministry of Digital Transformation said about 100,000 households in Kyiv and the surrounding region had internet problems after the September 23 attack. Repair crews were still counting damaged kit while operators shifted traffic. The Institute for the Study of War later described Russian attacks on Kyiv data centers across three consecutive days, September 23 to 25.

Internet monitor NetBlocks recorded a partial loss of connectivity on Wednesday on at least four networks serving Ukraine: Kyiv Link, Pautina, Utels and Crazy Network. Ukrainian tech reporters, compiling company messages, said four Kyiv data centers were damaged that day and that more than ten providers reported damage between September 23 and 25. Several firms can sit in one building, so the provider count is not a count of separate ruins.

Foreign Minister Andrii Sybiha said Russia was seeking to disrupt the flow of information, and that rapid alerts about missiles and drones need a working civilian net. “This is critical civilian infrastructure that ensures people can access life-saving information. It is not a military target. It is essential to keeping everyday life functioning,” he wrote.

THE DATES OF THE CONNECTIVITY ATTACKS

1. September 23, 2026: Strikes damage Kyiv data centers and cut internet to about 100,000 households. Two people are killed and at least 43 are injured in the wider Kyiv attack. That evening a fire breaks out at the Starlink ground station in Wola Krobowska, Poland.
2. September 24, 2026: More Kyiv providers report damaged nodes and hosting kit. Polish digital minister Krzysztof Gawkowski calls the Wola Krobowska fire sabotage. Investigators from the Internal Security Agency and police work the scene.
3. September 25, 2026: A drone hits the Solomianskyi office building that houses Datagroup’s data center; four people die and seven are injured, including a child. Cosmonova also reports damage. President Volodymyr Zelenskyy orders extra protection for data centers after a meeting of the Staff of the Supreme Commander-in-Chief.
4. September 26, 2026: A second strike damages Cosmonova’s backbone network. NetBlocks logs a fresh disruption on that network. Cosmonova’s Kolo.TB brand reports a third hit and a harder recovery.

Russia has hit Ukrainian telecom sites throughout the war, including a major Kyiv data-center strike in July and damage this month at Kyivstar facilities that the company said did not stop service. What changed in late September was the pace: several civilian server rooms in a few days, plus a fire at a satellite gateway on NATO territory the same night the first Kyiv wave began.

A Starlink Hub in Poland Catches Fire

The blaze started on the evening of September 23 at a ground station in Wola Krobowska, about 50 kilometres south of Warsaw. The site is run by Exatel, Poland’s state telecom company, and is one of two regional Starlink gateways that also serve Ukraine; the other is near Kaunas in Lithuania. The fire took the power gear and a backup generator. Firefighters put it out. No one was hurt, and the station kept working.

Gawkowski, who is also deputy prime minister, told TVP Info the fire was built to kill the station and to cut internet for institutions that include the Ukrainian military. He said many signs fit what he called Russia’s new doctrine of attack, while adding that investigators had not proved who did it. Prime Minister Donald Tusk said the episode looked bad and that he would not slap the sabotage label on it without certainty.

This was sabotage and an attempt to disrupt the operation of a vital station that is crucial for the security and continuity of internet services in Ukraine.

Krzysztof Gawkowski, Polish deputy prime minister and digital affairs minister, on TVP Info

Poland’s National Prosecutor’s Office later opened an investigation into arson and diversion. Prosecutors said the fire was the result of arson, and that there is a justified suspicion the attackers acted on orders from Russian special services against Poland. The stated aim, in the filing, was to disrupt Starlink traffic in Poland and other countries in Central and Eastern Europe. Work at the scene began on September 24 with the Internal Security Agency and the Central Bureau of Investigation. No one has been charged.

That legal caution sits beside a simpler operational fact. Whoever lit the generator room chose the backup power, not the dishes. A station that stays online after a fire is still a station someone tried to black out on the same night Kyiv’s fiber nodes were burning.

Four Dead at the Solomianskyi Office Strike

On September 25 a drone struck an office building in Kyiv’s Solomianskyi district, a tech cluster locals still call Inkom, also branded Compass FM, near the corner of Vadyma Hetmana and Simi Brodskykh streets. Mayor Vitali Klitschko said four people were killed and seven were injured, including a child. At least three of the dead were found in the car park. The facade was torn up and windows were blown out. A nearby medical facility was damaged as well.

Datagroup, one of Ukraine’s largest telecom companies, confirmed that its data center in the building was damaged. “Client data is safe, and all services continue to operate from backup locations. We had planned infrastructure redundancies, so even after the data center was damaged we are still keeping services running,” the company said. Specialists were still measuring the wreck when that statement went out.

The four dead were not Datagroup employees. The company said its workers were unharmed. Across Kyiv on September 25, Klitschko’s tally rose to five people killed and 31 injured, 15 of them in hospital, including two children. The fifth death was a 14-year-old boy, an Israeli citizen, killed in a separate strike on a residential building in the Pecherskyi district, according to Israel’s foreign ministry.

Zelenskyy tied the data-center hits to a wider run at ordinary life that same day, including a warehouse used by McDonald’s. “The Russians are constantly expanding their escalation operation: American and other businesses, data centers, internet providers,” he wrote. “All this affects people’s ability to stay connected, study, work.”

Why Moscow Is Going After the Internet Now

The Institute for the Study of War, in a September 25 campaign note, said Russian forces have intensified strikes on Ukrainian data centers and telecom sites since mid-September as Moscow looks for a search for alternative defeat mechanisms after 2026 offensives failed to meet their aims. The note treats the data-center push as an economic and civilian-network campaign that follows earlier strikes on ports, railways and logistics, not as a proven takedown of Ukraine’s military comms.

Russia’s Defence Ministry has been explicit in the opposite direction. It said the September 23 strikes hit the New-Telco and United DC sites in Kyiv and that those halls served Ukraine’s defence ministry and security agencies, claims Ukrainian officials have not confirmed. After the Datagroup strike it said the site processed intelligence for Ukraine’s armed forces. After the Cosmonova hits it said the hall supported mobile internet and Starlink for the Ukrainian military.

WHERE OFFICIALS DISAGREE

• Moscow’s line: The Defence Ministry says the Kyiv halls are military comms and intelligence nodes, including Starlink support for the armed forces.
• Kyiv’s line: Oleksandr Fedienko, deputy head of parliament’s digital transformation committee, says there is no evidence the strikes damaged military communications or government networks.
• The operators’ line: Datagroup, Cosmonova, Pavutyna, UTELS and others describe civilian internet and hosting sites that failed over to backup floors and, in some cases, to kit already sitting abroad.

Both things can be true in a city where army traffic and home broadband share buildings. A civilian data center can still carry traffic a general staff cares about. A strike that kills people in a car park is still a strike on a city block, whatever is in the basement. The open question is whether Russia is trying to blind brigades, or to make Kyiv’s banks, courts, shops and air-raid pop-ups stutter through the winter.

Backup Sites Kept Most Home Lines Running

Serhiy Beskrestnov, a presidential adviser on defense technologies known as Flash, said Ukraine has one of the world’s most distributed internet networks and that these strikes are unlikely to leave the whole country dark. Fedienko said outages should be short because operators rebuild fast, and he told people who need a stable line for work or school to keep two providers. A former government telecom official, quoted in the industry press, put the share of the sector already hardened for this kind of attack at about 90 percent, with key nodes duplicated.

The restoration times from September 23 are the hard evidence behind that claim. They are also the bill. Beskrestnov warned that operators’ costs will rise, and that home internet prices may follow.

WHAT EACH HIT DID TO SERVICE

Cityhost said some of its Kyiv kit was destroyed and that it was rebuilding on reserve gear stored abroad. Etherlink said it had to move the core of its network after its main node was hit, then reported service back by the morning of September 25. Domonet said switching kit was damaged and that it had a full restore by midday on September 24. KIEVNET reported a powerless data center and possible outages in central Kyiv. FAUST reported damaged gear. FEX.NET reported trouble reaching some files and said user data survived.

HOW OPERATORS KEPT TRAFFIC MOVING

• Second floors: Datagroup and Cosmonova both said client data was intact because they had already copied services onto reserve sites.
• Foreign racks: MiroHost and Cityhost leaned on equipment that was already outside Ukraine, which is why a destroyed Kyiv hall did not take most of their customers with it.
• Moved cores: Etherlink physically shifted its network core after the main node was hit, a slower fix than a software failover but one that brought the line back within a day.
• Two-hour cutovers: Pavutyna and UTELS got most home customers back in about two hours, which is the practical meaning of a distributed net when a single hall dies.

That is not a promise that the next strike will be as kind. A network that heals in two hours still drops air-raid apps, card terminals and school links for those two hours. Repeat the hit on the backup hall, as Cosmonova learned on Saturday, and the heal time stretches.

Saturday’s Repeat Hit on Cosmonova

Cosmonova’s first damage came on September 25 at Protasov Business Park on Mykola Hrinchenko Street, a complex that also houses other IT offices. The company said staff were safe, that client data sat on geographic backups, and that services were running on reserve sites with possible short outages. FAUST, which shares the area, reported a general accident and then a fix by that evening.

On Saturday morning the same hall was hit again. “Unfortunately, after the morning enemy strike, another attack occurred on our data center. All employees are safe,” Cosmonova said. “Due to the repeated attack, problems arose in the operation of services. The backbone network was damaged.” State Emergency Service crews were on site. Cosmonova engineers were waiting to be let in before they could measure the hole in the backbone.

Kolo.TB, Cosmonova’s internet brand, said it was the third hit and that “this time the situation is much more difficult,” with reserves being spun up and routes being changed. Lanet separately reported television problems. NetBlocks, updating its earlier Kyiv measurements, said metrics showed a new disruption on Cosmonova after the drone attack. Russia’s Defence Ministry said the target supported Starlink for Ukrainian forces. Cosmonova’s own statements describe a civilian backbone and customer outages, not a military dish farm.

Serhii Sternenko, a well-known blogger and former government adviser, had already told Kyiv residents to prepare for winter by getting Starlink terminals or other ways to stay online. He wrote that Russia’s aim is to strike the capital’s energy system and to destroy data centers and internet operators. The advice is practical. It is also now circular. The terrestrial net is being punched in Kyiv, and the satellite on-ramp in Poland was set on fire the night that punching began. A dish on a balcony does not help if the gateway that talks to it is dark, and a gateway that survives a generator fire can still be tried again.

Zelenskyy said the extra protection decisions from the September 25 command meeting must be carried out at every level, with ministers and security chiefs personally responsible. Fedienko’s two-provider habit, Beskrestnov’s cost warning, and Sternenko’s dish on the windowsill are the civilian version of the same order. Cosmonova’s engineers, still waiting behind firefighters for a look at a twice-hit backbone, are the test of whether those backups were copied far enough.