Pro-Ukraine hackers hit Aeroflot’s IT systems, forcing over 100 flight cancellations and chaos at Moscow’s Sheremetyevo airport

Russia’s state-owned flag carrier Aeroflot reported a major failure to its information systems on Monday morning, warning of potential disruptions to its services. Shortly after the announcement, the airline announced the cancellation of at least 114 flights to and from Moscow.

According to the online departures board at Sheremetyevo Airport, the airline canceled flights to 25 cities across Russia, as well as to Yerevan, Minsk, Tashkent, and Astana. The first canceled flight was scheduled for 8:35 a.m., and the latest had been set to depart at 7:20 p.m. on July 29.

Pro-Ukraine hacker groups Silent Crow and Belarusian Cyber Partisans claimed responsibility for what they called a “long and large-scale operation that led to the complete compromise and destruction of Aeroflot’s internal IT infrastructure.” The groups allege that the year-long operation allowed them to “access and download the entire flight history database,” “compromise all critical corporate systems,” and “gain control over employees’ personal computers, including those of senior management.”

The hackers further claimed to have “copied data from wiretapping servers, including audio recordings of phone conversations and intercepted communications,” as well as “extracted data from surveillance and personnel monitoring systems.” According to the statement, the hackers destroyed 7,000 servers, both physical and virtual, resulting in the loss of all data stored on them. Recovering these systems, they claim, “could cost tens of millions of dollars.”

The hacker groups’ joint declaration continued:

“Our operation is a direct message:

To the FSB, NCCCI, RT-Solar and other so-called ‘cyber defenders’ — you are incapable of protecting even your key infrastructure. To all members of the repressive apparatus — your digital security is worthless, and you’ve long been under surveillance.

A partial release of the obtained data will begin shortly. We didn’t just destroy the infrastructure — we left a mark.

Glory to Ukraine! Long live Belarus!”

The Belarusian Cyber Partisans reported on their website that the attack on Aeroflot was made possible thanks to the airline’s use of outdated Windows software and poor password practices by employees.

Aeroflot CEO Sergei Alexandrovsky, they claimed, had not changed his password since 2022.

Russia’s Prosecutor General’s Office confirmed that a hacker attack was the cause of the disruption to Aeroflot’s information systems. “Based on materials from a prosecutorial review, a criminal case has been opened under Part 4 of Article 272 of the Russian Criminal Code (unlawful access to computer information),” the agency said in a statement.

It also noted that an investigation has been launched into the flight delays and cancellations caused by the cyberattack.

Following the attack on Aeroflot, a major outage was also reported on Russia’s state services portal, Gosuslugi. According to a report by The Moscow Times that cited data from Downdetector, the highest number of complaints is coming from Moscow (23%) and St. Petersburg (11%). Issues have also been reported in the Yamalo-Nenets Autonomous District, as well as in the Nizhny Novgorod, Kaluga, Tver, and Sverdlovsk regions.

Users say the site is inaccessible, that pages are failing to load, and that they are unable to log into their personal accounts. Nearly 60% of complaints relate to the web version of the portal, while 23% concern the mobile app.

In January, Silent Crow claimed responsibility for hacking the database of Russia’s Federal Service for State Registration, Cadastre and Cartography (Rosreestr), releasing a portion of what they said was data from the Unified State Register of Real Estate (EGRN).

Cyber Partisans is a Belarusian hacktivist group known for targeting Belarusian government systems. The group identifies itself as part of the opposition to the regime of Alexander Lukashenko.