Dozens of Aeroflot flights were cancelled on Monday 28 July 2025, after a devastating cyber-attack on digital infrastructure across Russia. Responsibility for the giant hack has been claimed by pro-Ukrainian groups.
Reuters reports airport departure boards “turning red” just as schedules were due to serve Russian holidaymakers going away for their peak vacation season. Hundreds of delayed passengers milled around Moscow’s Sheremetyevo airport, Aeroflot’s hub, and subsidiaries Rossiya and Pobeda airlines were also affected, and no recovery timeframe was immediately forthcoming.
😋У Москві — авіаційний хаос: білоруські хакери паралізували «Аерофлот»
— Kyiv24 (@kyiv_tv) July 28, 2025
Хакерські групи Silent Crow та «Кіберпартизани BY» заявили, що знищили IT-інфраструктуру «Аерофлоту».
За їхніми словами, операцію готували майже рік. Хакерам вдалося проникнути у внутрішню мережу компанії,… pic.twitter.com/EeagKrjiWC
“In the service of unfriendly states”
The incident has been described as “quite alarming” by the Kremlin, and the country’s legislators are viewing it as a warning sign. Anton Gorelkin, a longtime proponent of a so-called “sovereign internet” in Russia, governed by state surveillance and partitioned off from the rest of the online world, said in a statement: “We must not forget that the war against our country is being waged on all fronts, including the digital one. And I do not rule out that the ‘hacktivists’ who claimed responsibility for the incident are in the service of unfriendly states.”
Similarly, Anton Nemkin, a politician who is a former Federal Security Service member and Sochi Digital Valley fund founder, called for action to identify not only the hackers but also “those who allowed systemic failures in protection”.
Online hacker group Silent Crow, alongside the Belarusian Cyberpartisans, has publicly owned the attack on Telegram. They claimed it would help “Ukrainians in their fight with the occupier, carrying out a cyber strike on Aeroflot and paralysing the largest airline in Russia.”
🚨 BREAKING: Hackers claim they’ve breached the systems of Russian airline giant Aeroflot
— NEXTA (@nexta_tv) July 28, 2025
The groups Silent Crow and Belarusian Cyber-Partisans say they have completely destroyed the company’s IT infrastructure✈️
According to them, the operation lasted a year and ended in a… pic.twitter.com/Dj92PDY746
Costs estimated in the tens of millions of dollars
They had worked for a year to infiltrate Aeroflot’s network, destroy 7,000 servers, and take over employee and manager computers. They also stole data from “all Russians who have ever flown with Aeroflot”, which they have threatened to release. The guerilla group anticipates that the overall cost to Aeroflot will be in the “tens of millions of dollars.”
Сбой IT-систем «Аэрофлота»: отмены и задержки рейсов в 25+ аэропортах, включая Шереметьево (41 вылет отменён), Пулково (37 рейсов), Сочи, Минск, Ереван. Хакеры «Кверпарттизан» и Silent Crow заявили об атаке, уничтожении инфраструктуры и краже 20 ТБ данных#RussiaUkraineWar pic.twitter.com/H84wy8VgZs
— Alex Chizaro (@a_chizaro) July 28, 2025
As a result of the attack, Aeroflot was forced to ground over 40 mostly domestic flights as well as routes to Belarusian capital Minsk and the Armenian capital Yerevan. It issued a statement saying “Specialists are currently working to minimise the impact on the flight schedule and to restore normal service operations.” The markets however were unimpressed, with the Russian flag carrier’s shares dropping by 3.9% by 1300 GMT, below market benchmarks which in comparison were down only 1.4%.
