Techradar - All the latest technology news

Who was really behind the massive X cyberattack? Here’s what experts say about Elon Musk’s claims

A large-scale cyberattack caused multiple X outages on Monday 10 March. But is it really possible to identify where the attack originated?

Mar 15, 2025 - 10:03

Who was really behind the massive X cyberattack? Here’s what experts say about Elon Musk’s claims

X suffered outages on Monday 10 March due to a “massive cyberattack”
CEO Elon Musk attributed "IP addresses originating in the Ukraine area”
Security experts suggest the true origin of the attack cannot be identified

Tl;DR What cause the outage?

Analysts believe a distributed denial-of-service attack overloaded X’s servers with bogus traffic, interrupting access for genuine users. Because of the nature of the attack, it’s not really possible to identify with certainty where it originated. Hackers used devices in several regions, routing traffic through a number of hijacked IP addresses.

The social media platform X, formerly known as Twitter, suffered multiple outages on Monday 10 March. Thousands of X users in both the US and the UK reported being unable to access the website throughout the day.

Speaking to Fox Business, owner Elon Musk attributed the outages to a “massive cyberattack” and claimed that “IP addresses originating in the Ukraine area” were behind it.

With reported problems peaking at 40,000 on Downdetector, the scale of the outage is not in any doubt. It’s the most significant interruption of service that the platform has suffered in years, with the effects of the outages lasting for several hours.

But now the dust has settled, what exactly caused the outage? Here are the original theories, followed by the thoughts of cybersecurity experts...

The claim: Ukraine-based hackers were behind the X cyberattack

hacker on a computer — (Image credit: Towfiqu barbhuiya on Unsplash)

In the aftermath of the X outage, question marks remain over its cause – and who might be behind it.

Elon Musk took to X on Monday to share his belief that the attack had been carried out “with a lot of resources”. He went on to claim that "either a large, coordinated group and/or a country is involved", followed by his later comments on Fox Business that it came from “IP addresses originating in the Ukraine area”.