Experts have cast doubt on Elon Musk’s claim that a large-scale outage which hit X was caused by hackers in Ukraine.
Platform monitor Downdetector says it had more than 1.6 million reports of problems with the social media site from users around the world on Monday.
“We’re not sure exactly what happened but there was a massive cyber-attack to try and bring down the X system with IP [Internet Protocol] addresses originating in the Ukraine area,” Musk said in an interview with the Fox Business channel.
However, Ciaran Martin, professor at Oxford University’s Blavatnik School of Government told the BBC that explanation was “wholly unconvincing” and “pretty much garbage.”
Prof Martin – former head of the UK’s National Cyber Security Centre – says it looks as if X was targeted by what’s known as a distributed denial of service (DDoS) attack, where hackers flood a server with internet traffic to prevent users from connecting to a website.
“It’s not that sophisticated – it’s a very old technique,” Mr Martin told Radio 4’s Today programme.
“I can’t think of a company of the size and standing internationally of X that’s fallen over to a DDoS attack for a very long time,” he added.
He said the incident at X “doesn’t reflect well on their cyber security.”
Many users trying to access the platform and refresh feeds on its app and desktop site during Monday’s outages were met with a loading icon.
Musk, who has been a frequent critic of Ukraine and its President Volodymyr Zelensky, has offered no evidence to support his claim and did not say whether or not he thought state actors were involved.
He posted on X that “either a large, coordinated group and/or a country is involved”.
But Prof Martin said tracing IP addresses “tells you absolutely nothing,” because hackers in this situation would hijack devices from all over the world.
The BBC has approached the Ukrainian embassy in Washington DC for comment.
Alp Toker, director of Netblocks, which monitors the connectivity of web services, said its own metrics suggested the outages could well be linked to a cyber attack.
“What we’ve been seeing is consistent with what we’ve seen in past denial of service attacks, rather than a configuration or coding error in the platform,” he told the BBC.
He said the organisation has seen several major outages spanning more than six hours on Monday, “each having global impact”.
“This is amongst the longest X/Twitter outages we’ve tracked in terms of duration, and the pattern is consistent with a denial of service attack targeting X’s infrastructure at scale,” he added.
Musk has previously claimed that the platform has been targeted by DDoS attacks, but these have not been confirmed.
Like all major social networks, X is a regular target for disruptive and attention seeking attacks.
But X has a track record of falling due to these attacks much more than other larger sites like Facebook and Instagram.
In 2023, a small group of hackers called Anonymous Sudan took the site offline in more than a dozen countries for hours in an attempt to pressurise Elon Musk into launching his Starlink service in their country.
Two men were arrested in 2024 for being the ringleaders of the group – showing that hackers can disrupt X with DDoS attacks from anywhere in the world with the right tools and expertise.
Cyber specialists are seeing a “sharp rise” in DDoS attacks which are becoming “an increasingly popular tool” for criminals, according to Sian John, chief technology officer at cyber security company NCC Group.
“Businesses that store large amounts of sensitive data, like tech firms, financial institutions, and healthcare providers, are frequent targets,” she said.
“But any organisation with an online presence is at risk.”
Additional reporting by Joe Tidy, Imran Rahman-Jones and Chris Vallance.