On July 28, 2025, state‑run airline Aeroflot suffered a catastrophic cyberattack that incapacitated its internal IT systems, grounding dozens of flights and causing extensive travel disruptions. The incident occurred during Russia’s peak summer travel season, as many Russians were on holiday . The hacker groups Silent Crow and Belarusian Cyber Partisans publicly claimed responsibility, stating they had compromised Aeroflot’s network for nearly a year and destroyed 7,000 servers, accessing customer and employee data . They also warned of releasing sensitive files and recordings .
The Russian Prosecutor General’s Office confirmed the outage was cyber‑related and launched a criminal investigation. Officials described the incident as deeply alarming and a wake‑up call for enhanced cybersecurity across critical national infrastructure . Analysts warn that fully restoring Aeroflot’s IT capabilities could take anywhere from two months to a year, given the scale of damage .
Passengers expressed frustration over poor communication and service breakdowns, with booking and refund systems rendered inoperable. Aeroflot’s subsidiaries Rossiya and Pobeda were also affected, amplifying operational chaos at Sheremetyevo Airport . The attack highlights an urgent need for modern detection systems like NDR, PAM, and behavior‑based real‑time monitoring in aviation cybersecurity frameworks.
#Aeroflot
#Cyberattack
#SilentCrow
#BelarusianCyberPartisans
#FlightCancellations
#ITBreach
#AirportChaos
#Cybersecurity
#CriticalInfrastructure
#DataTheft
