Russia’s flagship state-owned carrier, Aeroflot, was hit by a significant cyberattack on Monday, leading to a mass outage of its computer systems and forcing the cancellation of over 100 flights, with many others delayed.
The disruption caused widespread chaos at Moscow’s Sheremetyevo airport, Aeroflot’s base, where images shared on social media depicted hundreds of delayed passengers. The outage also impacted flights operated by Aeroflot’s subsidiaries, Rossiya and Pobeda. While primarily affecting domestic routes, the cyberattack also led to cancellations for some international flights to Belarus, Armenia, and Uzbekistan.
Initially, Aeroflot issued a statement warning passengers of “unspecified difficulties” with its information technology system. However, Russia’s Prosecutor’s Office later confirmed the incident was a cyberattack and announced a criminal investigation had been launched. Kremlin spokesperson Dmitry Peskov described reports of the attack as “quite alarming,” adding that “the hacker threat is a threat that remains for all large companies providing services to the general public.”
Ukrainian hacker group Silent Crow and Belarusian hacker activist group the Belarus Cyber-Partisans, which opposes the rule of Belarusian President Alexander Lukashenko, both claimed responsibility for the assault.
Silent Crow asserted via Telegram that it had maintained access to Aeroflot’s corporate network for a year, during which time it copied customer and internal data, including audio recordings of phone calls, employee surveillance data, and other intercepted communications. The group claimed that these resources are now “inaccessible or destroyed and restoring them will possibly require tens of millions of dollars. The damage is strategic.” The channel also shared screenshots purporting to show Aeroflot’s internal IT systems, insinuating that seized data could be released soon. “The personal data of all Russians who have ever flown with Aeroflot have now also gone on a trip — albeit without luggage and to the same destination,” it stated. These claims could not be independently verified.
The Belarus Cyber-Partisans told The Associated Press they had hoped to “deliver a crushing blow.” The group has a history of claiming responsibility for cyberattacks, including an alleged infiltration of Belarus’s main KGB security agency in April 2024. Group coordinator Yuliana Shametavets described the Aeroflot incident as “a very large-scale attack and one of the most painful in terms of consequences,” adding that the group had prepared for several months, exploiting various vulnerabilities to penetrate the airline’s network.
Belarus is a close ally of Russia, with President Lukashenko having allowed Russia to use his country’s territory for the full-scale invasion of Ukraine and for the deployment of tactical nuclear weapons. The incident follows a summer of repeated mass delays at Russian airports, often due to Ukrainian drone attacks prompting flight groundings over safety concerns.
