Travel disruptions have become common in Russia since the Ukraine conflict began, often due to Ukrainian drones cutting through airspace, but this is the first time a cyberattack has caused such a blockage.
Russia’s state prosecutor’s office said it had opened a criminal investigation after flights were disrupted at Moscow’s main Sheremetyevo airport, Aeroflot’s home base, calling it “a hacking attack”.
Aeroflot referred only to a “breakdown in the IT system”, saying at least 64 flights were grounded on Monday and cancelling 14 more for Tuesday.
“We’ve already arrived at the airport and found out that the flight has been cancelled,” Mikhail, a passenger waiting at Sheremetyevo, told AFP.
“This is not the first flight cancelled in July for us,” he said. “It’s sad, it’s impossible to plan business trips.”
The Ukrainian hacking group Silent Crow and the Belarusian group Cyber Partisans claimed responsibility for the attack.
“We announce the successful completion of a long-term and large-scale operation that resulted in the complete compromise and destruction of the internal IT infrastructure of Aeroflot,” they said in a joint statement.
The attack was made possible by lax security, Cyber Partisans said in a separate statement, claiming that Aeroflot’s CEO Sergei Alexandrovsky had not changed his password since 2022.
They said the company was also using outdated software such as the “Windows XP and Windows 2003” operating systems.
The hackers hinted they would publish the personal data of all Russians who had flown with Aeroflot.
Russia’s cybersecurity watchdog Roskomnadzor did not confirm the data leak, state news agency RIA Novosti reported.
Aeroflot said that it was “working to restore normal operation as quickly as possible,” adding that most of its flights were operating according to schedule.
The Kremlin said it was alarmed by the incident.
“We will, of course, clarify the information and wait for an appropriate explanation,” spokesman Dmitry Peskov told reporters.
Ukraine and its allies have long accused Russia of state-backed cyberwarfare, disrupting government and private IT systems around the world and damaging critical infrastructure.
The European anti-crime body Europol said this month that it had dismantled a pro-Russian hacking group accused of launching thousands of online attacks against Ukraine and its allies.