Russian Banking and Metro Payment Outage Disrupts Cards, ATMs, and Mobile Apps
A widespread outage disrupted banking apps and payment systems across Russia, leaving customers unable to make card payments, withdraw cash, or access mobile banking for several hours. Major banks including Sberbank, VTB, Alfa-Bank, T-Bank, and Gazprombank were affected, while payment failures also hit public transport in Moscow, where metro and suburban train turnstiles reportedly stopped accepting cards.
Russian authorities said the incident was caused by a technical failure at one bank and insisted customer funds were not affected, but the exact cause was not publicly confirmed. Russian media and local experts pointed to a problem at Sberbank that may have cascaded across the financial sector because of its central role in acquiring, while other reports tied the disruption to Roskomnadzor internet-blocking activity and the government’s broader campaign against VPN services; independent media later said outlets were ordered to remove reporting that linked the outage to VPN restrictions.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Roskomnadzor reportedly orders removal of VPN-outage coverage
Independent media later reported that Roskomnadzor instructed outlets to delete or remove reports linking the banking outage to the agency's VPN-blocking efforts. This marked an official censorship response to public reporting about the suspected cause.
Media links outage to Roskomnadzor VPN-blocking efforts
Russian media and public figures, including Natalia Kasperskaya, publicly connected the outage to Roskomnadzor's internet blocking campaign and possible blocking of IP addresses used by banking infrastructure. This explanation remained unconfirmed by authorities.
Russian officials attribute outage to technical failure at one bank
Russian authorities said the disruption was caused by a technical failure at a single bank and stated that customer funds were not affected. Reporting and expert commentary indicated the issue may have originated at Sberbank and cascaded because of its central role in payment processing.
Banking and payment outage disrupts services across Russia
A major outage knocked out mobile banking, card payments, cash withdrawals, and some ATM services for customers of major Russian banks including Sberbank, VTB, Alfa-Bank, T-Bank, and Gazprombank. The disruption also affected fare payments on Moscow metro and some suburban train systems for several hours.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
4 references tracked. Mallory keeps watching after this page renders.
Whoops: Russia’s Attempt To Block VPNs Causes Major Banking Failure | Techdirt
techdirt.com
Open sourceMajor outage cripples Russian banking apps and metro payments nationwide
securityaffairs.com
Open sourceMajor outage hits Russian banking apps, metro payments across regions | The Record from Recorded Future News
therecord.media
Open sourceВ России массовый сбой банков. Переводы не работают, карты не принимаются, наличные не снять - CNews
cnews.ru
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Moscow Internet Blackouts and State-Approved Web Access
Russian authorities are restricting internet access in Moscow during ongoing mobile network disruptions by allowing connectivity only to a **government-approved whitelist** of domestic websites and services. Reporting indicates the system keeps selected Russian platforms—such as government sites, telecom services, marketplaces, and transport or delivery apps—available while broader internet access is blocked, reportedly using **deep packet inspection (DPI)** and infrastructure controls that require traffic to stay within Russia and prevent users from masking IP addresses. Officials have framed the outages and restrictions as protective measures against **Ukrainian drone attacks**, while similar controls are reportedly being prepared or used in other Russian cities including St. Petersburg. The disruptions are also producing visible social and economic effects in Moscow, where residents and businesses are struggling with failed QR-code payments, degraded app-based services, and loss of normal mobile connectivity. One account describes a broader regression to offline workarounds, including increased demand for **walkie-talkies, pagers, and paper maps**, as GPS-dependent and internet-based services become unreliable. A separate report on **Kazakhstan's** proposed social media monitoring regime concerns a different country and policy process and does not describe the same Moscow outage and whitelist event.
Apr 21, 2026
DDoS Attack Disrupts Perm's Parking Payment System
A **distributed denial-of-service (DDoS) attack** disrupted the automated parking payment system in **Perm, Russia**, taking the city’s parking portal and related payment services offline and temporarily making parking free. Local authorities said the attack overwhelmed the infrastructure used to process payments, preventing drivers from paying through the official app and website. As a result, officials waived penalties for unpaid parking during the outage window of **March 10–13**, while weekend parking remained free under normal city policy. City officials later said the parking system had been fully restored and that all payment methods were working again. The incident adds to a pattern of cyber disruptions affecting parking services in Russian cities, including earlier outages in **Krasnodar** and **Tver**, though no group has claimed responsibility for the Perm attack and any link to prior incidents remains unconfirmed. One report also notes the broader context that DDoS attacks commonly flood online services with malicious traffic to exhaust capacity and block legitimate transactions.
Mar 21, 2026
Cyberattack Disrupts Delta Smart Alarm Services in Russia, Stranding Vehicle and Security System Users
A **cyberattack** disrupted operations at **Delta**, a Russian provider of alarm and security systems for homes, businesses, and vehicles, causing widespread outages and customer complaints. Delta described the incident as a “**large-scale**” and “well-organized” external attack, with company leadership claiming it originated from an unspecified **hostile foreign state**; Delta also said it had **no evidence** at the time that customers’ personal data had been compromised. As services went down, Delta’s **website and phone lines** remained offline into the following day, forcing the company to communicate with customers via **VKontakte** while it worked to restore systems from backups amid concerns about follow-on attacks. The outage had immediate real-world impact, particularly for users of Delta’s vehicle security features: reports described customers being unable to **unlock cars**, **disable alarms**, or use **remote start**, with some accounts alleging doors locking unexpectedly and even **engines shutting down while in motion**. Separate reporting noted Delta’s app (launched in 2020) supports tracking vehicle location and stores **payment data**, increasing customer concern about potential exposure if Delta’s internal systems were breached; however, no threat actor has claimed responsibility and it remains unclear whether the disruption was caused by **DDoS** or a more destructive intrusion such as **ransomware** or a **wiper**.
Mar 21, 2026