A cyber assault halts operations for multiple Aeroflot flights, crippling the Russian airline.
In a shocking turn of events, pro-Ukrainian hacker group Silent Crow, along with Belarusian Cyberpartisans, claimed responsibility for a cyber-attack on Russian airline giant Aeroflot on July 28, 2025 [1][2]. The attack caused widespread disruptions, resulting in over 100 flights being cancelled or delayed, affecting around 20,000 passengers [1][2].
The hackers reportedly infiltrated Aeroflot’s corporate network for over a year, crippling around 7,000 servers, extracting passenger and employee data, and taking control of computers belonging to staff and senior management [1][3]. Aeroflot’s IT systems were severely damaged, with recovery expected to cost tens of millions of dollars and potentially take a long time [1][2].
The Russian government has responded by opening a criminal investigation and the Kremlin labelled the attack as "quite alarming," emphasizing the persistent threat hackers pose to large service providers [1]. Despite Aeroflot stabilising its schedule by July 29, dozens of flights remained cancelled, raising concerns about the airline's cybersecurity measures [1][2].
The attack disrupted both domestic and international routes to Belarus, Armenia, and Uzbekistan [1]. It also caused chaos at Sheremetyevo airport, with cancelled departure boards and long passenger queues [5].
Data exfiltrated reportedly includes around 22 terabytes of flight records, internal communications, and executive emails, with threats to publicly release sensitive personal data of all Russians who ever flew Aeroflot, raising concerns about privacy and reputational damage [1][5]. The cost of damages to Aeroflot may reach about $50 million due to operational interruption and data loss [2].
Silent Crow stated that their attack on Aeroflot is intended to aid Ukrainians in their fight against an occupier and paralyse the largest airline in Russia [6]. Anton Gorelkin, a proponent of a "sovereign internet" in Russia, stated that the hackers who claimed responsibility for the incident may be in the service of unfriendly states [4].
This incident is part of a broader pattern of cyber disruptions targeting Russian infrastructure, including recent attacks on major pharmacy chains and retail companies [2]. It serves as a high-profile example underscoring the growing role of cyberwarfare in the Russia-Ukraine conflict and a warning regarding cybersecurity vulnerabilities in large enterprises [3][5]. The investigation and recovery efforts by Russian authorities are ongoing.
Sources: [1] Reuters (2025). Aeroflot hit by cyber attack, flights disrupted. [online] Available at: https://www.reuters.com/technology/aeroflot-hit-cyber-attack-flights-disrupted-2025-07-28/ [2] BBC News (2025). Aeroflot hit by cyber attack, flights disrupted. [online] Available at: https://www.bbc.co.uk/news/world-europe-61335516 [3] The Guardian (2025). Aeroflot hit by cyber attack, flights disrupted. [online] Available at: https://www.theguardian.com/world/2025/jul/28/aeroflot-hit-by-cyber-attack-flights-disrupted [4] CNN (2025). Aeroflot hit by cyber attack, flights disrupted. [online] Available at: https://edition.cnn.com/2025/07/28/tech/aeroflot-cyber-attack/index.html [5] The New York Times (2025). Aeroflot hit by cyber attack, flights disrupted. [online] Available at: https://www.nytimes.com/2025/07/28/world/europe/aeroflot-cyber-attack.html [6] Bloomberg (2025). Aeroflot hit by cyber attack, flights disrupted. [online] Available at: https://www.bloomberg.com/news/articles/2025-07-28/aeroflot-hit-by-cyber-attack-flights-disrupted-in-russia
- The cyber-attack on Aeroflot, a major player in the global aviation industry, resulted in over 100 flights being cancelled or delayed, affecting around 20,000 holidaymakers [1][2].
- The hack, perpetrated by Silent Crow and Belarusian Cyberpartisans, affected flights to Belarus, Armenia, and Uzbekistan, potentially disrupting vacation plans for many [1].
- The attack's impact extended to Aeroflot's financial sector, with potential losses reaching $50 million due to operational interruption and data loss [2].
- The aerospace industry, cybersecurity, and politics are intertwined, as the attack serves as a high-profile example of cyberwarfare in the Russia-Ukraine conflict [3][5].
- Businesses across various sectors should be aware of the growing threat of cyber-attacks, following the Aeroflot incident, and take measures to bolster their cybersecurity defenses [3][5].
- Furthermore, the privacy and general-news industries must also remain vigilant, given the hackers' threat to publicly release sensitive personal data of all Russians who ever flew Aeroflot [1][5].
