Aviation Under Siege: The 2025 Airline and Airport Cyberattack Crisis
The aviation industry is facing an unprecedented wave of cyberattacks in 2025, with major airlines and airports worldwide falling victim to sophisticated hacking operations that have compromised millions of passengers' personal data and disrupted critical infrastructure systems.
Breached Company
The Scattered Spider Campaign
A notorious cybercriminal group has shifted its attention to the aviation industry, successfully breaching the computer networks of multiple airlines in the United States and Canada this month, according to FBI reports and cybersecurity experts. Microsoft, in a report published on July 16, 2025, said it has observed Scattered Spider targeting the airlines industry, stating the activity aligns with the threat actor's patterns of concentrating on one sector for several weeks or months before moving on to new targets.
The FBI has directly linked several high-profile aviation breaches to the Scattered Spider hacking group, which has become one of the most prolific cybercriminal organizations operating today. The group has been tied to attacks on Las Vegas casinos in 2023 and British department stores earlier this year.
Breached Company
Major Airline Victims: Detailed Analysis
Qantas Airways - The Most Devastating Breach
The most severe breach disclosed involves Australia's flagship carrier, Qantas Airways. Australian airline Qantas has confirmed that the personal information of 5.7 million customers was compromised after hackers breached a third-party platform used by one of its call centers. The attack, detected on Monday, July 1, 2025, compromised a staggering amount of sensitive data.
What Was Stolen: The breach exposed names, email addresses, phone numbers, and other personal information stored in Qantas's customer database. The stolen information includes names, email addresses, phone numbers and potentially frequent flyer account details, representing one of the largest airline data breaches in history.
Attack Method: Qantas disclosed that it detected a cyberattack on Monday after threat actors gained access to a third-party platform containing customer data. The hackers infiltrated a contact center system rather than Qantas's primary infrastructure, highlighting the vulnerability of third-party vendors.
Breached Company
WestJet - Early Warning Signs
Canada's second-largest airline fell victim to attackers on June 13, 2025, serving as one of the first major indicators of Scattered Spider's aviation campaign.
Impact on Operations: WestJet said a "cybersecurity incident" disrupted some of its internal systems and its app, limiting customers' access to the company's website and WestJet app. The attack caused intermittent interruptions and errors across multiple customer-facing platforms.
Company Response: "WestJet is aware of a cybersecurity incident involving internal systems and the WestJet app, which has restricted access for several users. We have activated specialized internal teams in cooperation with law enforcement and Transport Canada to investigate the matter and limit impacts," the airline stated in its official response.
Recovery Efforts: A WestJet spokesperson told NBC News in an email that the company first noticed it had been hacked on June 13 and has made "significant progress" to resolve it. The airline worked with third-party forensic experts throughout the recovery process.
Hawaiian Airlines - Island Paradise Compromised
Hawaiian Airlines disclosed its cybersecurity incident on Friday, June 28, 2025, just weeks after the WestJet attack, confirming the coordinated nature of the campaign.
Breached Company
Operational Impact: Unlike some other breaches, Hawaiian Airlines discloses cyberattack, flights not affected, allowing the airline to maintain its flight operations throughout the incident. However, the breach still compromised sensitive customer and operational data.
Attribution: Multiple incident responders have attributed recent cyberattacks on Hawaiian Airlines and Canada's WestJet to Scattered Spider, the same group behind devastating 2023 breaches of MGM Resorts and Caesars Entertainment.
Timeline: Hawaiian Airlines said in a Friday filing with the Securities and Exchange Commission that it had detected the cybersecurity incident, making it one of the more transparent disclosures in terms of regulatory compliance.
Breached Company
The Coordinated Nature of Attacks
Multiple airlines have reported cyber attacks in the past week as the FBI warns that a cybercriminal group has started targeting the industry. The timing of these breaches—occurring just ahead of the Fourth of July holiday travel surge—suggests a deliberate strategy to maximize disruption during peak travel season.
Airport Infrastructure Attacks
The crisis extends beyond airlines to critical airport infrastructure. In March 2025, Kuala Lumpur International Airport (KLIA) faced a crippling cyberattack, with hackers demanding a $10 million ransom. The breach disrupted critical airport systems, triggering Malaysia's national cybersecurity response.
Additionally, in March 2025, a major U.S. airport experienced a coordinated DDoS (Distributed Denial-of-Service) attack that temporarily knocked out flight information displays, online ticketing, and check-in systems. Though flights weren't grounded, travelers faced considerable confusion and delays.
The Scale of the Threat
The aviation industry is experiencing what experts describe as a cybersecurity crisis. Aviation cybersecurity 2025 faces unprecedented threats with 131% attack surge, representing a dramatic escalation in both the frequency and sophistication of attacks targeting the sector.
The rapid evolution of AI and other advanced technologies is causing a rise in cyber threats, making them harder to detect and prevent. By 2025, these attacks are expected to become more sophisticated and frequent, posing a growing threat to critical infrastructure.
Attack Methods and Advanced Tactics
The Scattered Spider group employs sophisticated social engineering tactics that set them apart from typical cybercriminal organizations. The FBI's techniques "often involve methods to bypass multi-factor authentication (MFA), such as convincing help desk services to add unauthorized MFA devices to compromised accounts," representing a concerning evolution in attack methodology.
Breached Company
Social Engineering Mastery
In June 2025, Hawaiian Airlines, WestJet, and Qantas reported cyberattacks, which authorities attribute to the Scattered Spider group's social engineering tactics. These methods often involve manipulating employees through carefully crafted phone calls, emails, or other communication channels to gain unauthorized access to systems.
Multi-Factor Authentication Bypass
One of Scattered Spider's most concerning capabilities is their ability to circumvent MFA protections. Rather than breaking encryption or exploiting software vulnerabilities, they manipulate human psychology and organizational processes to gain legitimate access credentials.
Third-Party Vendor Exploitation
The Qantas breach highlights another key tactic: targeting third-party vendors and service providers rather than attacking airlines directly. By compromising contact centers, maintenance systems, or other outsourced services, attackers can gain access to airline networks through trusted pathways that may have fewer security controls.
Google's Threat Intelligence Group described Scattered Spider as initially targeting telecommunications companies to support SIM-swapping schemes and then later shifting to ransomware and data theft extortion by early 2023. The group's evolution demonstrates their adaptability and growing ambition in targeting larger, more complex organizations.
Additional Recent Breaches and Incidents
North American Aviation Under Siege
At least two North American airlines have recently been victims of hackers as cybersecurity firms warn that cybercriminals are targeting the aviation industry. The coordinated nature of these attacks suggests a well-planned campaign rather than opportunistic strikes.
International Airport Vulnerabilities
Beyond individual airlines, airport infrastructure has proven equally vulnerable. The Kuala Lumpur International Airport (KLIA) incident in March 2025 involved hackers demanding a $10 million ransom, demonstrating that entire airport ecosystems—not just individual carriers—are at risk.
Breached Company
The Pattern of Escalation
The vendor alerts come as multiple incident responders have attributed recent cyberattacks on Hawaiian Airlines and Canada's WestJet to Scattered Spider, the same group behind devastating 2023 breaches of MGM Resorts and Caesars Entertainment that cost the companies millions of dollars. This represents a clear escalation in both target selection and potential impact.
Recognizing the severity of the threat, airports are ramping up cybersecurity in 2025 as digital threats like ransomware become a top concern across the industry. Upgrading legacy systems is a commercial priority, with 9 in 10 airport leaders ready to invest in stronger cyber protection.
The Transportation Security Administration (TSA) has also implemented new cybersecurity amendments specifically targeting the aviation sector, requiring enhanced security measures and incident reporting protocols.
Law Enforcement Response
In a brief statement on Friday shared with TechCrunch, the FBI said it had "recently observed" cyberattacks resembling Scattered Spider to include the airline sector. Federal authorities are working closely with cybersecurity firms and affected organizations to track the perpetrators and prevent further attacks.
Major cybersecurity companies including Google's Mandiant division and Palo Alto Networks' Unit 42 research team are actively investigating the aviation sector attacks and providing threat intelligence to potential targets.
Looking Ahead
The aviation industry's struggle with cybersecurity reflects broader vulnerabilities in critical infrastructure sectors. As airlines and airports rely increasingly on interconnected digital systems for everything from passenger check-in to air traffic management, the potential impact of successful cyberattacks continues to grow.
The current wave of attacks serves as a stark reminder that the aviation industry must treat cybersecurity as a fundamental operational requirement rather than an IT afterthought. With millions of passengers' personal data at risk and critical transportation infrastructure vulnerable to disruption, the stakes have never been higher for implementing robust cybersecurity defenses across the entire aviation ecosystem.
As the Scattered Spider group and other cybercriminal organizations continue to evolve their tactics, the aviation industry faces an ongoing battle to stay ahead of increasingly sophisticated threats. The events of 2025 may well serve as a turning point that forces the sector to fundamentally rethink its approach to cybersecurity in an interconnected world.
