‘Completely compromised’ Ukrainian and Belarusian hackers claim responsibility for IT outage that disrupted over 100 flights in Russia

A major disruption to the Russian airline Aeroflot’s IT systems caused widespread service outages and forced the airline to cancel or delay numerous flights on Monday. In a midday statement, the airline said it was “making emergency adjustments to its flight schedule, including partial cancellations” due to the system failure.

Aeroflot urged passengers to monitor updates on airport websites, as well as flight information displays and loudspeaker announcements in terminals. The airline said it was working to “minimize risks to its operating schedule” and restore services as quickly as possible.

Altogether, Aeroflot and its affiliate airlines Rossiya and Pobeda canceled more than 100 flights. By noon, Aeroflot said it had canceled 49 round-trip flights from Moscow to destinations across Russia and to Yerevan, Minsk, and Astana. Some Rossiya flights were also scrapped, as the airline is part of the Aeroflot group. At least eight other round-trip flights were delayed, including those between Moscow and Tashkent. Between midnight and noon, the airline completed 76 of 123 scheduled flights to or from Moscow’s Sheremetyevo Airport.

The IT outage also disrupted operations at Pobeda. A message on the low-cost carrier’s website warned customers of delays and cancellations, though the exact number of affected flights was not provided.

Russia’s Transport Ministry said it was working with the Federal Air Transport Agency and Aeroflot to rebook some passengers onto flights operated by Rossiya and Pobeda.

Aeroflot has also canceled some flights scheduled for later in the week. According to its website, more than 350 Aeroflot and Rossiya departures from Moscow were planned for July 28, with 22 listed as canceled. Over 60 more flights have been canceled through Saturday: 21 on Tuesday, 12 on Wednesday, 18 on Thursday, and five each on Friday and Saturday. It’s unclear how many of these cancellations were directly caused by the IT failure.

Aeroflot has promised to offer refunds or ticket exchanges but says it can’t process them yet. The airline said passengers on canceled flights will be able to get a refund or rebook within 10 days, but only once its systems are back online. For now, only certain categories of passengers — including families with children, unaccompanied minors, people with disabilities, military personnel, and transfer passengers — can rebook their flights at Sheremetyevo.

Aeroflot and Sheremetyevo are urging passengers not to remain at the airport. The airline said baggage from canceled flights could be collected in the arrivals hall and asked passengers to leave the terminal to avoid overcrowding. “We ask passengers on canceled flights not to come to the departure airport,” the company wrote. Sheremetyevo’s press service added that passengers should “exit the secure zone before departure — staying in the terminal is not recommended.” The airport said that tickets could be exchanged or refunded remotely.

Moscow news outlet Msk1 reported long lines at Sheremetyevo due to the outage. Passengers told reporters that flights were being delayed or canceled without explanation. Around 10:00 a.m., several people told the Telegram channel Ostorozhno, Moskva that they had received no updates on their flights or that their flights had simply disappeared from the boards. Photos and videos circulating online showed crowds forming throughout the airport.

A pro-Ukrainian hacker group called Silent Crow has claimed responsibility for the disruption. In a statement, the group said it carried out the operation in collaboration with the Belarusian hacktivist collective Cyber Partisans. According to the hackers, the prolonged and large-scale breach “completely compromised and destroyed Aeroflot’s internal IT infrastructure.”

“We spent a year inside their corporate network, gradually expanding our access and digging down to the very core of their infrastructure — Tier0,” the group said.

Silent Crow said it had accessed the airline’s full flight history database, compromised all critical corporate systems, taken control of employee computers — including those of top executives — and destroyed around 7,000 physical and virtual servers. “We extracted 12 terabytes of databases, eight terabytes of files from Windows Share, and two terabytes of corporate email,” the statement said.

Russia’s Prosecutor General’s Office confirmed that Aeroflot had been hit by a cyberattack but did not provide further details. It announced that it had launched “oversight measures in response to flight delays and cancellations at Sheremetyevo Airport.” Officials said the cause was “a failure in Aeroflot’s information systems as a result of a hacker attack.” A criminal case has been opened under the Russian Criminal Code’s article on unlawful access to computer information that causes serious consequences or poses a threat.

This is not the first time flights at Sheremetyevo have been widely delayed or canceled in recent months. Moscow airports, including Sheremetyevo, have repeatedly suspended flights due to drone attacks by Ukraine. Russia’s Federal Air Transport Agency has responded by temporarily closing airspace to ensure passenger safety.

We usually do the talking at fundraisers. This time, we’ll let our readers speak for us. “I’m just a regular guy who recently graduated from college and used to send Meduza a hundred rubles every month. Putin stole my country from me, took away my ability to speak out, and even my freedom to spend my own hundred rubles. Please help Meduza! Freedom for Russia!” — Anonymous