EditCyberattack on Aeroflot exposes fragility of Russia’s digital defences
More than 50 flights cancelled, thousands stranded as pro-Ukrainian hacktivists claim responsibility for paralyzing the state airline
Russia’s flagship airline, Aeroflot, was forced to cancel over 50 round-trip flights on Monday (28 July) after a coordinated cyberattack severely disrupted its IT infrastructure, highlighting the growing role of digital warfare in the broader conflict sparked by Russia’s full-scale invasion of Ukraine.
The Kremlin acknowledged the seriousness of the attack, with spokesman Dmitry Peskov calling the situation “alarming.” Prosecutors confirmed that Aeroflot’s internal systems had been compromised and opened a criminal investigation into the breach. Lawmakers described the disruption as a wake-up call for the country’s cybersecurity strategy.
The hacking collective Silent Crow claimed responsibility for the attack, stating it had worked in partnership with the Belarusian Cyber Partisans – a well-known anti-Lukashenko group that supports Ukraine. In a post on Telegram, Silent Crow claimed the year-long operation had “completely destroyed” over 7,000 servers and infiltrated the personal computers of senior Aeroflot staff. The hackers posted screenshots allegedly from within the airline’s internal network and threatened to release personal data of “all Russians who have ever flown Aeroflot,” including staff communications and email correspondence.
While the full extent of the breach has not been independently verified, Aeroflot confirmed that 54 round-trip flights were cancelled, with dozens more delayed across Moscow’s Sheremetyevo Airport. The disruption coincided with peak holiday travel season in Russia, stranding passengers in airports with little information and no access to the airline’s digital services.
“A disaster for a national brand”
“This is a serious disaster,” former Aeroflot pilot and aviation expert Andrei Litvinov told Reuters. “Flight delays are survivable. But if all the corporate data is exposed, the long-term damage could be immense.”
The attack is one of the most visibly disruptive digital assaults on a major Russian company since the war began. Silent Crow’s past operations include targeting Russia’s real estate database, state telecom services, and government IT departments, often resulting in data leaks. However, Monday’s attack stands out for its scale and immediate impact on tens of thousands of civilians.
Aeroflot’s share price dropped 3.9% by Monday afternoon, underperforming the broader market amid mounting concern. Though the airline said it aimed to operate the majority of its 260 scheduled flights, passengers flooded Russian social media with frustration over missing flights, unresponsive call centers, and non-functioning apps and websites.
“Since 3:30 I’ve been sitting at Volgograd airport,” wrote one passenger on VKontakte. “The flight has been rescheduled three times already. No information, no help.” Another commented: “Call center is down. How are we supposed to rebook or get a refund?”
Aeroflot said affected passengers would be allowed to rebook or claim refunds once systems were restored, and authorities noted that alternative carriers would absorb some of the traffic.
Cyberwar escalates beyond the battlefield
Russian lawmakers were quick to frame the attack as part of a broader geopolitical offensive. “The war against our country is being waged on all fronts, including the digital one,” said Anton Gorelkin, deputy head of the Duma committee on information policy. He accused the hackers of possibly acting under direction from “unfriendly states.”
Another MP, Anton Nemkin, urged investigators to identify not only the perpetrators, but also those who had enabled such “systemic failures” in cybersecurity.
The Belarusian Cyber Partisans described the operation as a show of solidarity with Ukraine: “We are helping Ukrainians in their fight with the occupier, carrying out a cyber strike on Aeroflot and paralysing the largest airline in Russia,” the group said.
While the groups involved are publicly identifying as “hacktivists,” cyber experts have long warned that some such collectives may operate with the quiet support or coordination of state intelligence services on both sides of the conflict. So far, Ukraine has not officially commented on the incident.
Though Russia’s civil aviation sector has been repeatedly hit by disruptions since 2022, often due to drone attacks on airfields or sanctions-related supply chain issues, this incident is unusual in that it originated entirely in cyberspace and caused immediate disruption on a national scale.
Monday’s attack underscores how warfare in the 21st century increasingly includes attacks on digital infrastructure, with civilian services becoming frequent collateral, or primary targets, in hybrid conflict.
Caption: File photo. Passengers examine departure table waiting their flights at Sheremetyevo International Airport outside Moscow, Russia, 7 July 2025. According to the Russian Ministry of Transport, 241 flights were delayed and 158 flights were cancelled at Sheremetyevo Airport in Moscow over the past 24 hours due to a possible attack by Ukrainian drones. EPA/YURI KOCHETKOV
Updated: July 29, 2025 - 10:55
