Moscow Metro targeted in likely retaliatory cyberattack

The Moscow subway’s website and mobile app experienced disruptions on Monday, with many users saying that they couldn’t access their personal accounts a day later. A likely retaliatory cyberattack is suspected after Russian-aligned threat actors hacked Ukrainian Railways.

On March 31st, 2025, the Russian Center for Monitoring and Control of the Public Communication Network (CMU SSOP) issued a warning about a surge in complaints about the Moscow Metro application at 6 a.m.

The issue remained in the afternoon, and the center said “Specialists are working to address the problem.”

However, on Tuesday, dozens of users still couldn’t access their personal accounts and claimed that the Moscow Metro app did not work, according to the complaints filed with downdetector.su.

The Moscow subway likely experienced a cyberattack, as its website was defaced to display a banner with a message that was previously displayed on the Ukrainian Railways (Ukrzaliznytsia) website.

Ukrzaliznytsia was hacked on March 23rd and users were unable to use the website and app to buy tickets, the Kyiv Independent reports.

“Ukrzaliznytsia has temporarily switched to paper document management and is working to restore all services,” the banner on the Moscow Metro website said.

The Moscow transport department acknowledged the issues on its Telegram channel, informing users that they may encounter temporary problems accessing personal accounts.

At the time of writing, the Moscow Metro (mosmetro.ru) website is not accessible from foreign IP addresses. However, the local detectors report the service as being available.