Aeroflot Cyberattack Disrupts Russian Air Travel
- Pro-Ukrainian hacking groups claim responsibility for a significant cyberattack on Russia’s Aeroflot, leading to over 50 canceled flights and widespread disruption.
- The incident has prompted a criminal investigation and raised concerns within the Kremlin about digital security vulnerabilities.
Aeroflot Faces Major Disruptions
Russian national airline Aeroflot experienced widespread flight cancellations and delays on Monday, impacting numerous travelers. Over 50 round-trip flights were canceled, significantly disrupting air travel across Russia. This incident has been attributed to a claimed cyberattack by pro-Ukrainian hacking organizations.
The Kremlin acknowledged the seriousness of the situation, with spokesman Dmitry Peskov calling the information “quite alarming.” Lawmakers, including Anton Gorelkin, characterized the attack as a “wake-up call” for Russia’s digital defenses, suggesting potential involvement of “unfriendly states.” Prosecutors have launched a criminal investigation into the disruption, confirming it was indeed caused by a hack.
Aeroflot has not specified a timeline for resolving the technical issues. Departure boards at Moscow’s Sheremetyevo Airport showed numerous flights delayed or canceled, creating significant inconvenience for passengers during a peak holiday period. The airline’s shares also saw a decline of 3.9% following the news, underperforming the broader market.
The company stated it canceled 54 round-trip flights but aimed to operate 206 out of 260 scheduled flights for the day. Specialists are reportedly working to minimize the impact on the flight schedule and restore normal service operations. Passengers were advised that refunds or rebookings would be possible once systems were restored, with efforts being made to secure seats on other airlines.
Hackers Claim Extensive Damage
Two groups, “Silent Crow” and “Belarusian Cyberpartisans,” have publicly claimed responsibility for the cyberattack. A statement from Silent Crow, also published by Belarusian Cyberpartisans, asserted a year-long operation to penetrate Aeroflot’s network. They claim to have destroyed 7,000 servers and gained control over employee computers, including those of senior management.
These groups have published screenshots purporting to show file directories from within Aeroflot’s network. They have also threatened to release personal data of all Russians who have flown with Aeroflot, alongside intercepted conversations and emails of airline staff. Silent Crow has a history of claiming responsibility for attacks on Russian entities, including a real estate database and a state telecoms company, some of which resulted in significant data leaks.
The Belarusian Cyberpartisans, a group opposed to President Alexander Lukashenko, stated on their website their intent to “paralyse the largest airline in Russia” to assist Ukrainians in their conflict. These claims suggest a coordinated and deep-reaching operation. There has been no immediate comment from Ukraine regarding these claims.
Broader Implications and Passenger Frustration
This incident represents one of the most significant cyberattacks impacting a high-profile Russian entity since the 2022 invasion of Ukraine. While Russian companies and government websites have faced sporadic hacking attempts, the widespread disruption to Aeroflot highlights a potentially new level of vulnerability. Andrei Litvinov, an aviation expert, described the situation as a “serious disaster,” citing “huge losses for a state-owned company.”
Litvinov also warned about the long-term consequences if corporate data and correspondence are exposed, suggesting an internal disruption following external pressures like drone attacks. Passengers expressed significant frustration on social media platforms like VK, complaining about a severe lack of information from Aeroflot. Many reported extended delays and difficulties in contacting the airline or accessing its services.
One passenger, Malena Ashi, described waiting at Volgograd airport for hours, with her flight rescheduled multiple times. Another, Yulia Pakhota, highlighted the unavailability of the call center, website, and app, questioning how she could manage her ticket. Despite Western sanctions limiting travel, Aeroflot remains a significant global airline, serving 55.3 million passengers last year, making this cyberattack particularly impactful.
Beyond the immediate operational disruptions, this incident underscores the increasing role of “hacktivism” in geopolitical conflicts. While state-sponsored cyber warfare is well-documented, the self-proclaimed involvement of groups like Silent Crow and Belarusian Cyberpartisans highlights how non-state actors are leveraging digital tools to influence real-world events. This blurs the lines between traditional warfare and cyber conflict, presenting unique challenges for national security and corporate infrastructure alike.
