Aeroflot Aeroflops Over ‘it Issues’ After Attackers Claim Year Long Compromise

Russia’s largest airline, Aeroflot, canceled numerous flights on Monday morning following what it says was a failure in its IT systems – something hacktivists are claiming responsiblity for.

Several flights departing from and arriving at Moscow’s Sheremetyevo Airport were either delayed or canceled entirely, with passengers told to pay attention to announcements made at affected airports.

Aeroflot said via its Telegram channel: “There was a failure in the airline’s information systems. Service interruptions are possible.

“In this regard, a forced adjustment to the flight schedule is expected, including by postponing and canceling. We ask passengers to monitor the information on the online boards of airport websites throughout the airline’s route network, airport information boards, and announcements over the airport’s loudspeaker.

“Currently, a team of specialists is working to minimize the risks of fulfilling the production flight plan and quickly restoring the normal operation of services.

“The airline apologizes for the inconvenience caused.”

A total of 42 flights were canceled at first, with a further seven announced hours after, while additional trips were delayed by varying times from 25 minutes up to, in some cases, nearly three hours.

Passengers scheduled to travel on the canceled flights were told to retrieve their checked luggage from baggage claim and leave the airport to prevent overcrowding.

Affected travelers have the option of claiming a refund on their tickets or rebooking their flight within the next ten days.

However, Aeroflot said airport ticket offices “are temporarily not processing refunds or rebooking tickets,” without explaining why.

These services will become available once more after the airline’s services are up and running again, it added.

“At the moment, Sheremetyevo Airport is reissuing tickets only for special categories of passengers: passengers and groups with children, unaccompanied children, passengers with disabilities, SVO participants, and passengers traveling by transfer.”

Aeroflot still ranks among the world’s top 20 airlines by passenger numbers, despite the extensive sanctions and restrictions placed on it following Russia’s invasion of Ukraine in 2022.

Pre-war, the airline ran regular routes to global travel hubs including New York, Los Angeles, Miami, Washington DC, London, Frankfurt, Paris, Rome, and more.

However after Russia-controlled airlines were banned from large swathes of Western airspace, these routes have remained suspended, significantly harming the company’s finances to the extent that the Kremlin had to step in with economic support.

Aeroflot had to switch its business to focus on increasing domestic flights and those to countries with which Russia has close ties. Despite rising fuel costs and severe limitations on access to spare parts, it returned to profit in 2024.

The airline carried up to 37.2 million passengers annually before the war, per 2019 figures, but this dropped to just 20.5 million in 2022. As of 2024, numbers are back up to 30.1 million, which still represents a 19 percent decrease on pre-war traffic.

Hacktivists crow about attack

The Silent Crow and Cyberpartisans BY (Belarus) hacktivist groups claimed responsibility for today’s disruption, which they said follows a year-long compromise of the airline’s systems.

Via Telegram, they claimed to have compromised “all critical corporate systems,” including Aeroflot’s SharePoint and Microsoft Exchange, those used for personnel surveillance, and more.

Silent Crow publishes screenshot it claims it took while inside Aeroflot’s systems – click to enlarge

The pair also claimed to have destroyed 7,000 servers and stolen 22 TB worth of data from databases, Windows Share, and corporate email, though these claims are unverified and may be exaggerated.

Their joint message took aim at Russia’s government and intelligence agencies, concluding: “Glory to Ukraine! Long live Belarus!” ®

Original Source