Russia's Aeroflot cancels dozens of flights after cyber attack causes IT outage

The Herald Scotland

28-07-2025

It is one of the most disruptive cyber attacks to hit Russia since the start of the country's full-scale invasion of Ukraine in February 2022.
The Aeroflot website alerting in Russian on temporary disruptions of the airline's services (Pavel Bednyakov/AP)
Previous attacks have targeted Russian government websites and other major Russian companies – notably the state-owned Russian Railways – but normal services have resumed within hours.
Images shared on social media showed hundreds of delayed passengers crowding Moscow's Sheremetyevo airport, where Aeroflot is based.
The outage also disrupted flights operated by Aeroflot's subsidiaries, Rossiya and Pobeda.
While most of the flights affected were domestic, the disruption also led to cancellations for some international flights to Belarus, Armenia and Uzbekistan.
In a statement released early on Monday, Aeroflot warned passengers that the company's IT system was experiencing unspecified difficulties and that disruption could follow.
Russia's prosecutor's office later confirmed that a cyber attack had caused the outage and that it had opened a criminal investigation.
Kremlin spokesperson Dmitry Peskov called reports of the attack 'quite alarming', adding that 'the hacker threat is a threat that remains for all large companies providing services to the general public'.
Silent Crow claimed it had accessed Aeroflot's corporate network for a year, copying customer and internal data, including audio recordings of phone calls, data from the company's own surveillance on employees and other intercepted communications.
'All of these resources are now inaccessible or destroyed and restoring them will possibly require tens of millions of dollars. The damage is strategic,' the channel purporting to be the Silent Crow group wrote on Telegram.
There was no way to independently verify its claims.
The same channel also shared screenshots that appeared to show Aeroflot's internal IT systems and insinuated that Silent Crow could begin sharing the data it had seized in the coming days.
'The personal data of all Russians who have ever flown with Aeroflot have now also gone on a trip – albeit without luggage and to the same destination,' it said.
The Belarus Cyber-Partisans told The Associated Press that it had hoped to 'deliver a crushing blow'.
The group has previously claimed responsibility for a number of cyber attacks, and said in April 2024 that it had been able to infiltrate the network of Belarus's main KGB security agency.
'This is a very large-scale attack and one of the most painful in terms of consequences,' group co-ordinator Yuliana Shametavets said.
She said the group had been preparing the attack for several months, and was able to penetrate the Aeroflot network by exploiting various vulnerabilities.
Belarus is a close ally of Russia.
Mr Lukashenko, who has ruled Belarus with an iron hand for more than 30 years and has relied on Russian subsidies and support, allowed Russia to use his country's territory to launch a full-scale invasion of Ukraine on February 24 2022 and to deploy some of Moscow's tactical nuclear weapons in Belarus.
Russia's airports have repeatedly faced mass delays over the summer as a result of Ukrainian drone attacks, with flights grounded amid safety concerns.