Aeroflot hit by mass flight cancellations after suspected cyber attack by pro Ukraine hackers

Dozens of Aeroflot flights departing Moscow’s Sheremetyevo airport were abruptly cancelled on Monday, leaving scores of holidaymakers stranded and raising pressing questions about the security of Russia’s aviation infrastructure. The disruption coincided with the height of the summer holiday season in Russia and caused significant frustration among travellers, many of whom took to social media to voice their anger at long waits and limited information.

The source of the chaos appears to be a targeted cyber attack orchestrated by the pro Ukraine hacking collective known as Silent Crow, working in alliance with the Belarusian group Cyber Partisans. In a statement, Silent Crow claimed responsibility for sabotaging Aeroflot’s information systems, boasting of a year long infiltration that reportedly destroyed 7000 servers and compromised computers used by senior management. The group threatened to imminently disclose the personal data of all Russians who have ever flown with Aeroflot, although no evidence has yet been produced to corroborate these claims.

Aeroflot cancelled in excess of 50 flights, affecting not only domestic routes but also services to Minsk and Yerevan. At least 10 further flights experienced delays as departure boards at Sheremetyevo airport turned red, reflecting the scale of the disruption. Both the airline and Russian aviation authorities have stayed largely silent on the details of the breach, fuelling passenger frustration and prompting the Kremlin to label the situation as worrying. State prosecutors have confirmed that the incident resulted from a hack and have launched a criminal investigation.

Silent Crow’s intervention came with a starkly political message linking the operation to ongoing hostilities in Ukraine. Cyber sabotage has become an increasingly common part of the conflict, with Ukrainian groups previously forming online armies for digital retaliation. The Cyber Partisans, meanwhile, have established a formidable reputation, having targeted Russian databases and government IT systems over several years.

Affected travellers described being unable to contact Aeroflot through its website, mobile application or call centre, complicating efforts to rebook or obtain refunds. The airline pledged that passengers impacted by the cancellations could return their tickets or rebook flights within ten days. Despite international sanctions sharply curtailing Aeroflot’s overseas operations following the invasion of Ukraine, the airline continues to rank amongst the world’s largest by passenger numbers, reporting 55.3 million journeys last year.

This high profile incident underscores the growing threat posed by politically motivated cyber attacks against critical infrastructure. While aviation remains on heightened alert, industry observers will be monitoring how Aeroflot and the wider Russian sector shore up defences against a new era of digital disruption.