Pro-Ukrainian hackers claim cyberattack on Aeroflot, leak CEO’s flight data

A coordinated cyberattack allegedly carried out by Ukrainian and Belarusian hacktivist groups disrupted operations at Aeroflot earlier this week, grounding dozens of flights and compromising sensitive internal systems, including the flight history of the Russian airline’s CEO.

Silent Crow, a Ukrainian hacking collective, and Cyber Partisans, a Belarusian group, claimed responsibility for the large-scale breach, which they say crippled Aeroflot’s IT infrastructure and accessed personal data on employees and passengers. The attack reportedly took place between Monday and Tuesday, forcing the cancellation of more than 40 flights and triggering widespread delays. Russia’s Transportation Ministry attributed the disruption to an unspecified “IT failure,” while federal prosecutors later confirmed a hacker attack and opened a criminal investigation.

Aeroflot and Russian officials initially denied that any sensitive information had been leaked. However, in apparent response, Cyber Partisans published a redacted screenshot on Telegram showing what they claimed to be Aeroflot CEO Sergei Alexandrovsky’s flight history from April 2024 to June 2025. The image included Alexandrovsky’s birthdate and domestic travel details, while obscuring parts of his name and passport number.

"Expect more Aeroflot leaks in the near future," Cyber Partisans wrote, alleging they had taken over employee computers, accessed surveillance and wiretapping systems, and destroyed nearly 7,000 servers. They also claimed that Alexandrovsky had not changed his password since 2022.

Aeroflot has not publicly commented on the hackers’ claims, which remain unverified. Russia’s media regulator, Roskomnadzor, has stated there is no official confirmation of any data breach.

Silent Crow, which has supported Ukraine’s digital campaign against Russia, described the breach as a “prolonged and large-scale operation” that “completely destroyed” Aeroflot’s IT systems. The group also threatened to publish the personal data of all passengers who have flown with the airline. "Glory to Ukraine! Long live Belarus!" Silent Crow wrote in a Telegram post.

Cyber Partisans echoed the sentiment on their website, calling the operation a cyber strike in solidarity with Ukraine and in opposition to Russia’s continued occupation and Belarusian authoritarianism. The group, active since 2022, has previously targeted government and transportation infrastructure across Russia and Belarus.