«Aeroflot» was prepared to be attacked for a year: hackers claim to have destroyed more than 7,000 servers of the airline

The hacking groups Silent Crow, together with the «Cyber-Partisans BY» community (a group of Belarusian hackers operating outside the country), claimed responsibility for the disruptions in Aeroflot's operations on July 28, 2025. The airline has already canceled 49 flights from Moscow.

According to the attackers, the operation lasted about a year and led to the complete destruction of critical corporate systems. According to the hackers, they gained access to databases of flight history, CRM systems, as well as the Sabre, 1C and Microsoft Exchange platforms.

As a result of the attack, about 7,000 servers were destroyed, and more than 20 terabytes of data were stolen, including corporate mail and internal documents. The damage from the cyberattack could be tens of millions of dollars.

At the moment, Aeroflot has not commented on the incident. However, Sheremetyevo Airport recorded massive delays and cancellations of flights. Aeroflot flights to Kazan, Orenburg, Sochi, Kaliningrad, Chelyabinsk, Murmansk, St. Petersburg, Istanbul, Volgograd and others were postponed for two hours.

In May 2025, Aeroflot switched to the domestic digital aviation communication service «air-to-ground» (Aircraft Communications Addressing and Reporting System — a digital communication system for transmitting short messages between an aircraft and ground stations; ACARS). Previously, the airline worked with foreign solution providers through Iridium, Inmarsat satellite channels and SITA/ARINC infrastructure.

Read materials on the topic:

Irkutsk will have to work hard: Aeroflot plans to receive more than 100 MS-21 aircraft

AI on the rise: Aeroflot will transfer up to 70% of customer interactions to neural networks

Aeroflot aircraft connected to the Russian ACARS data transmission system