NEVERHACK Estonia
31.07.2025
In a world where cyber warfare increasingly mirrors kinetic conflict, the aviation industry—one of the most critical infrastructures globally—faces a clear and present danger. This was demonstrated when Russia’s national carrier, Aeroflot, suffered a cyberattack in July 2025, forcing the airline to cancel dozens of flights and reportedly destroying 7,000 servers.
The group that’s claimed to be behind the assault, two hacktivist collectives called Silent Crow and Cyber Partisans, claimed it had infiltrated Aeroflot’s systems for over a year, exfiltrated 20 terabytes of data, and rendered core IT infrastructure useless. The group’s message was clear: “You are incapable of protecting even your most critical infrastructure.”
This incident is not an isolated one. It reflects a growing trend in cyber warfare where aviation, alongside other domains, becomes a high-value target for political, economic, or ideological disruption.
Airlines are being targeted
Airlines sit at the convergence of critical data, national security, and public convenience. They rely on digital systems for flight operations, passenger data management, cargo tracking, maintenance scheduling, and communication. Disrupt just one layer, and the ripple effects can ground fleets and endanger passengers.
Cyberattacks on airlines can have various objectives:
- Disruption of services: As seen with Aeroflot, grounding planes not only halts travel but also causes chaos in supply chains and geopolitical embarrassment.
- Espionage or data theft: From passport data to flight patterns of high-level personnel, airline systems contain goldmines of intelligence.
- Economic impact: Flight cancellations and system outages cost airlines millions—and shatter customer trust.
- Political signaling: Hacktivist groups often use high-profile targets to send messages, destabilize adversaries, or rally support.
How airlines have been hacked
Aeroflot’s attack is among the most destructive in recent memory, but it is far from the first. Consider these notable examples:
- EasyJet (2020): Hackers accessed email addresses and travel details of 9 million customers. The airline called it a “highly sophisticated attack.”
- Delta Airlines (2017): A vendor-related breach compromised customer data, underscoring the vulnerabilities in third-party systems.
- British Airways (2018): A data breach exposed personal and financial details of over 400,000 customers. The airline was fined £20 million for failing to protect user data.
- LOT Polish Airlines (2015): A cyberattack prevented the airline from issuing flight plans from Warsaw, grounding 10 planes and affecting 1,400 passengers.
These incidents reveal that attackers often exploit a range of vulnerabilities, from poorly secured APIs to outdated software and insufficient third-party vetting.
A wake-up call
What makes the alleged Silent Crow & Cyber Partisans operation against Aeroflot particularly chilling is the scale and patience involved. The hackers claim to have maintained access for an entire year, quietly siphoning data and mapping out the infrastructure before going scorched-earth on 7,000 servers.
This is not a ransomware shakedown—it’s cyber sabotage, and potentially a signal of a new phase of digital confrontation.
What’s more, Aeroflot is not just any airline—it is a national symbol and critical transportation link, especially for a country under international sanctions. Damaging it sends a powerful message to adversaries, domestic audiences, and the broader international community.
Why investment in cybersecurity is now non-negotiable
The aviation industry has long invested heavily in physical safety, and rightly so. But as digital systems increasingly determine everything from gate assignments all way to flight control, cybersecurity must become equally foundational.
Here’s what airlines and aviation regulators need to prioritize:
- Zero trust architecture: Assume that any system can be breached. Design networks and data flows accordingly, segmenting critical infrastructure from general IT systems.
- Continuous threat monitoring: Build or outsource security operations centers (SOCs) capable of real-time detection and response.
- Third-party risk management: Vendors and contractors often serve as weak links. Vet them rigorously and ensure they comply with your cyber hygiene standards.
- Incident response planning: Just as pilots train for emergencies, airlines need robust response protocols for cyber crises—tested through simulations and drills.
- Collaboration across borders: Aviation is global, and so are cyber threats. Airlines, governments, and international bodies like IATA and ICAO must share threat intelligence swiftly.
Final approach
The cyberattack on Aeroflot is a stark reminder that the aviation sector is not just a target of convenience—it’s a target of strategic importance. While hackers evolve rapidly, most airline security postures remain dangerously outdated.
As the lines between physical and cyber warfare blur, investing in cybersecurity is not just a matter of protecting servers—it’s about protecting national mobility, economic stability, and human lives.
Airlines must treat their digital resilience with the same rigor they apply to keeping planes in the sky. In the digital era, the next turbulence may not come from weather—but from a keyboard.
