Cyberattack forces Russia’s Aeroflot to Cancel Dozens of Flights

Russia’s flag carrier Aeroflot cancelled more than 40 flights on 28 July after reporting a major failure in its information systems. Passengers at Moscow’s Sheremetyevo airport faced chaotic scenes as the airline urged affected travellers to collect their luggage and leave. The disruption underscores the vulnerability of critical infrastructure to cyberattacks amid the ongoing war in Ukraine.

A statement circulating online from the hacking group Silent Crow claimed responsibility, saying it had collaborated with Belarusian activists Cyberpartisans BY. The message, which Reuters could not verify, linked the attack to Russia’s invasion of Ukraine and boasted of a year‑long operation that allegedly destroyed 7,000 servers and gained control over Aeroflot staff computers. Silent Crow previously attacked a Russian real‑estate database in January.

Aeroflot did not disclose the cause of the IT failure or estimate when service would return to normal. Since Moscow launched its full‑scale invasion of Ukraine in February 2022, Russian air travellers have become accustomed to delays, often because airports temporarily close due to drone attacks. A cyberattack aimed at crippling airline operations represents an escalation of non‑kinetic warfare.

The hack comes as Aeroflot remains among the top 20 airlines globally by passenger numbers. Despite international sanctions that limit its access to aircraft parts and routes, the carrier transported 55.3 million passengers in 2024. Disruption on this scale could undermine consumer confidence in Russia’s aviation sector and further isolate it from the global economy.

Silent Crow’s message threatened to publish the personal data of all Russians who have flown Aeroflot, raising privacy concerns. The episode echoes past cyber‑operations by hacktivists on both sides of the Ukraine conflict, such as attacks on Russian TV channels and Ukrainian infrastructure. It also highlights the blurred line between criminal and political hacking: some groups operate independently but align with geopolitical goals. As the war drags on, digital attacks on transportation and logistics companies may become more common.