Legal liability for cybercrime in Ukraine

The Criminal Code of Ukraine (hereinafter — the CC) has no separate article called “cybercrime”. The Law of Ukraine “On the Basic Principles of Ensuring Cybersecurity of Ukraine” defines cybercrime as a socially dangerous guilty act in cyberspace and/or using it, liability for which is provided for by the law on criminal liability and/or which is recognised as a crime by the international treaties of Ukraine (Article 1(1)(8)). But whether an act is criminally unlawful and how it is punished is determined only by the CC (Article 3(3) of the CC).

Criminal offences against computer systems: Articles 361–363-1 of the CC

These articles make up Section XVI of the CC. Fines here and below are in non-taxable minimum incomes of citizens (hereinafter — NTMI).

Unauthorised interference — Article 361

Article 361 of the CC punishes unauthorised interference in the operation of information (automated), electronic communication, information and communication systems and electronic communication networks. The sanction depends on the part:

• Part 1 — the interference itself: a fine of 1,000 to 3,000 NTMI, probation supervision or restriction of liberty for up to three years;
• Part 2 — repeatedly or by a group of persons by prior conspiracy: a fine of 3,000 to 7,000 NTMI, restriction of liberty or imprisonment for two to five years;
• Part 3 — if the interference led to leakage, loss, forgery or blocking of information, distortion of the process of its processing or violation of the routing procedure: a fine of 7,000 to 10,000 NTMI or imprisonment for three to eight years;
• Part 4 — significant damage or the danger of serious technological accidents, environmental disasters, deaths of people or other grave consequences: imprisonment for eight to twelve years;
• Part 5 — acts under Part 3 or 4 committed under martial law: imprisonment for ten to fifteen years.

Under Parts 3–5 the court may also deprive the person of the right to hold certain positions or engage in certain activities for up to three years, and under Part 5 it does so mandatorily. Significant damage in Articles 361–363-1 is damage that exceeds the NTMI by a factor of 300 or more (note to Article 361).

Malicious software, leakage of information, acts “from within”

• Article 361-1 — the creation, for the purpose of unlawful use, distribution or sale, as well as the distribution or sale, of malicious software or technical means intended for unauthorised interference. A fine of 2,000 to 4,000 NTMI, corrective labour for up to two years or imprisonment for up to three years; repeatedly, by a group of persons by prior conspiracy or with significant damage — imprisonment for up to five years.
• Article 361-2 — unauthorised sale or distribution of restricted-access information stored in computers, systems, networks or on media and protected in accordance with the legislation. A fine of 2,000 to 4,000 NTMI or imprisonment for up to two years; repeatedly, by prior conspiracy or with significant damage — two to five years.
• Article 362 — unauthorised acts with information committed by a person who has the right of access to it. Alteration, destruction or blocking — a fine of 2,000 to 4,000 NTMI or corrective labour for up to two years; interception or copying that led to leakage — up to three years of imprisonment with deprivation of the right to hold certain positions or engage in certain activities for the same period; repeatedly, by prior conspiracy or with significant damage — three to six years of imprisonment with deprivation of such a right for up to three years.
• Article 363 — violation of the rules for operating computers, automated systems or networks, or of the procedure or rules for protecting information, by a person responsible for their operation, if this caused significant damage. A fine of 2,000 to 4,000 NTMI, probation supervision or restriction of liberty for up to three years with deprivation of the right to hold certain positions.
• Article 363-1 — intentional mass distribution of telecommunication messages without the consent of the addressees, which disrupted or stopped the operation of computers, systems or networks. A fine of 2,000 to 4,000 NTMI or restriction of liberty for up to three years; repeatedly or by prior conspiracy, if significant damage was caused — restriction of liberty or imprisonment for up to five years with deprivation of the right to hold certain positions or engage in certain activities for up to three years.

When technology is only a method: fraud, fraud groups, cards

Fraud (Article 190 of the CC) — taking possession of another’s property or acquiring the right to property by deception or abuse of trust. Under Part 1 — a fine of 2,000 to 3,000 NTMI, community service for 200 to 240 hours, corrective labour for up to two years, probation supervision or restriction of liberty for up to three years. Repeatedly, by a group of persons by prior conspiracy or with significant damage to the victim — a fine of 3,000 to 4,000 NTMI, corrective labour for one to two years, restriction of liberty for up to five years or imprisonment for up to three years (Part 2). The thresholds here differ from those in Articles 361–363-1: significant damage — losses of 100 to 250 NTMI, taking into account the victim’s financial situation, a large amount — from 250 NTMI, a particularly large amount — from 600 NTMI (note to Article 185 of the CC). Fraud under martial law or a state of emergency that caused significant damage — a fine of 4,000 to 8,000 NTMI or imprisonment for three to five years (Part 3). Fraud in large amounts or by means of illegal operations using electronic computing equipment — Part 4: imprisonment for three to eight years. Whether a specific scheme meets the element “using technology” is decided in each case. In particularly large amounts or by an organised group — five to twelve years with confiscation of property (Part 5). What to do if you have been deceived is in the step-by-step instruction for a fraud victim.

Fraud group (Article 255-4 of the CC) — creating an electronic communication fraud organised group, leading it or participating in it. Such a group is an association of three or more persons, preliminarily organised for systematic fraud using electronic communications (note to Article 255-4). Creating it or leading it — seven to twelve years of imprisonment with confiscation of property; participation in the group or assistance to it with awareness of its unlawful nature — five to ten years; involving other persons in it — three to five years, in both cases with or without confiscation of property. Repeated involvement and acts by an official are punished more severely. A participant or a person who assisted the group (except the organiser and the leader) is released from criminal liability if, before the notice of suspicion, the person voluntarily reported the group to a law enforcement body and actively assisted in exposing it or stopping its activity (Article 255-4(7)).

Payment cards (Article 200 of the CC) — forgery of transfer documents, payment cards or other means of access to bank accounts, use or sale of forged cards and documents, unlawful issue or use of electronic money. The sanction is only a fine: 3,000 to 5,000 NTMI, repeatedly or by a group of persons by prior conspiracy — 5,000 to 10,000 NTMI. Taking possession of money from someone else’s genuine card is not covered by the elements of the article. For details, see the article on unlawful acts with payment cards.

Misdemeanour or crime, age and date of the act

The category of the act depends on the sanction (Article 12 of the CC). Article 361(1) is a criminal misdemeanour, Article 361(3) and Article 190(4) are serious crimes, Article 361(4) and (5) and Article 190(5) are particularly serious. How the category of the other parts is determined and what it changes is explained in the article on the classification of crimes by gravity.

Liability under all the named articles arises from the age of 16: they are not in the list of acts for which liability arises from the age of 14 (Article 22 of the CC).

Punishability is determined by the law that was in force at the time the act was committed (Article 4(2) of the CC), but a law that mitigates liability has retroactive effect, while a law that increases it does not (Article 5 of the CC). Articles 361 and 190 have been set out in new versions, so for old episodes the then-current and the current versions are compared.

If you are a suspect or a victim

How to act at each stage of the proceedings is covered in the article on the rights of the suspect and the victim in a cybercrime case. For the help of defence counsel or a representative of the victim, see the page “Criminal Law”.

The provisions are cited as currently in force as of 13 October 2026.