Aeroflot cyberattack: Russian airline hit hard, hackers claim deep network breach
Russian airline Aeroflot was hit by a major cyberattack, causing widespread flight delays and cancellations. Hacker groups Silent Crow and Belarus Cyber-Partisans claimed they destroyed 7,000 servers and accessed sensitive internal data. Russian authorities have launched a criminal investigation.
New Delhi: Russia’s largest airline, Aeroflot, came to a sudden halt this week after a cyberattack crippled its internal systems and left thousands of passengers stranded across airports. The incident, confirmed by Russia’s prosecutor’s office, forced Aeroflot to cancel over 100 flights and delay dozens more, including international routes to Belarus, Armenia, and Uzbekistan.
Two pro-Ukraine hacktivist groups, Silent Crow and the Belarus Cyber-Partisans, have claimed responsibility. They said the attack was the result of months of planning, aimed at delivering a strategic blow to one of Russia’s most high-profile companies.
The damage wasn’t just flight delays. Silent Crow has reportedly claimed in a Telegram post that they had been inside Aeroflot’s corporate network for nearly a year, stealing data and destroying critical infrastructure.
"All of these resources are now inaccessible or destroyed and restoring them will possibly require tens of millions of dollars. The damage is strategic,” the group said. They also claimed to have copied internal data, surveillance footage, phone recordings, and employee communications.
The Belarus Cyber-Partisans told Associated Press that the attack was intended to be "one of the most painful in terms of consequences.” Group coordinator Yuliana Shametavets said they had exploited multiple vulnerabilities over months to pull it off.
The Russian government isn’t brushing this one off. Kremlin spokesperson Dmitry Peskov said, "The hacker threat is a threat that remains for all large companies providing services to the population.”
Lawmakers called the attack a "wake-up call.” MP Anton Gorelkin said, "We must not forget that the war against our country is being waged on all fronts, including the digital one.” Another MP, Anton Nemkin, called for identifying both the attackers and those responsible for "systemic failures” in Aeroflot’s security.
Photos from social media showed chaos at Moscow’s Sheremetyevo Airport, where Aeroflot is based. Flight information boards turned red with delays. Passengers were left without answers or clear updates. At the peak of the disruption, only 206 out of 260 scheduled flights were expected to run.
Aeroflot confirmed its systems were hit but didn’t give details about how long recovery would take. "Specialists are currently working to minimise the impact on the flight schedule and to restore normal service operations,” the airline said.
According to media reports, screenshots shared by the hackers suggest they had deep access into Aeroflot’s internal systems. Silent Crow hinted they could begin leaking personal data of "all Russians who have ever flown with Aeroflot.”
They wrote, "The personal data of all Russians who have ever flown with Aeroflot have now also gone on a trip, albeit without luggage and to the same destination.”
The hack comes just as Russians begin their summer travel season. The timing made the impact even worse, leaving many travellers stuck with no way to rebook or get help.
Since the Russia-Ukraine war began in 2022, Russian infrastructure has been a regular cyber target. Government websites, telecom firms, insurance companies, and even Moscow’s IT department have all been hit in the past, often by the same groups.
But this attack might be the biggest one yet in terms of scale and visibility.
For now, Russia has launched a full-blown criminal investigation. Aeroflot hasn’t said when operations will be fully back to normal or if it plans to respond publicly to the hackers’ threats.