Aeroflot cyberattack forces flight cancellations, hackers claim breach

Russian airline Aeroflot cancelled dozens of flights on Tuesday following a massive cyberattack, but claimed its flight schedule had largely stabilized. The attack, claimed by two pro-Ukraine hacker groups, reportedly disrupted 7,000 servers and accessed sensitive employee and passenger data.

The hackers, Belarusian Cyber Partisans and the group Silent Crow, said they spent a year inside Aeroflot’s systems before launching the cyber assault on Monday. The operation also allegedly gave them access to personal computers of staff members—including senior managers.

Disruptions spread across two days

According to Interfax, Aeroflot canceled 59 round-trip flights from Moscow on Monday, out of 260 scheduled. On Tuesday, the airline cancelled another 22 outbound and 31 inbound flights.

Most Tuesday cancellations occurred before 10 a.m. Moscow time. After that, Aeroflot said operations returned to normal. “As of today, 93% of flights from Moscow and back are planned to be operated according to the original schedule,” the airline announced.

Still, the damage was done. Monday’s attack triggered massive delays across Russia’s air network and sparked frustration among affected travelers.

Hackers claim deep access to systems

In a statement, the Belarusian Cyber Partisans said they accessed Aeroflot’s internal network, downloaded sensitive files, and compromised systems at scale. Silent Crow, a newer and less-known group, also claimed involvement.

The groups allege they accessed everything from passenger data to employee records and internal infrastructure. This includes the personal devices of top managers—suggesting a deep and coordinated breach.

Russian lawmakers demand accountability

Russian officials responded by calling for an investigation not just into the hackers, but into potential security lapses inside Aeroflot. Lawmakers said the incident highlights the urgent need to upgrade cyber defenses.

While Aeroflot insists the schedule has stabilized, cybersecurity experts warn the long-term consequences may only be beginning—especially if sensitive data has been exfiltrated.

Conclusion

The Aeroflot cyberattack underscores the growing role of cyberwarfare in geopolitical conflicts. With hackers claiming deep access to critical infrastructure and airlines scrambling to recover, the incident is a reminder that aviation remains a top target for cyber threats. Aeroflot may have resumed most flights, but the digital damage could linger far longer.