Airlines Hit by Cyber Attacks: Here’s What to Know

Ahead of what is expected to be a busy holiday travel weekend in the U.S., multiple airlines reported experiencing cyber attacks to their IT systems. 

In North America, Hawaiian Airlines and WestJet have confirmed that they both experienced cyber attacks in the past week. The Federal Aviation Administration said in a statement on June 26 there had been no impact to safety with the Hawaiian Airlines attack. WestJet said that it launched an investigation into the attack. 

And Tuesday, Australian flag carrier Qantas said that it experienced a cyber attack that breached a third-party customer service platform. Qantas said that the breach has since been contained. 

The FBI said in a statement on June 28 that a cybercriminal group called Scattered Spider had started targeting the airline sector. 

“Once inside, Scattered Spider actors steal sensitive data for extortion and often deploy ransomware,” the FBI said.

The airlines that confirmed cyber attacks have not said whether ransomware was used or if extortion was involved. 

Here’s what to know about the cyber attacks:

What Is Scattered Spider?

Scattered Spider is a hacking group that is mostly based in the U.S. and U.K. The group received attention in 2023 when it was linked to a set of mulit-million dollar hacks at Caesars Entertainment and MGM Resorts. 

At the time, the two companies confirmed that Social Security numbers and customers’ driver license numbers linked to their loyalty accounts had been stolen. 

Scattered Spider was also linked to a spate of cyber attacks on insurance company Aflac, potentially stealing Social Security numbers, insurance claims, and health information. The cybercriminal group also targeted the retail sector in May.

The FBI said Scattered Spider often relies on “social engineering,” a tactic in which criminals impersonate employees or help desks to gain access to third-IT systems. 

“They target large corporations and their third-party IT providers, which means anyone in the airline ecosystem, including trusted vendors and contractors, could be at risk,” the agency said.

Why Are Airlines Being Targeted?

Like many other industries, airlines have a lot of valuable customer information on file, said John Rose, the chief risk officer of ALTOUR, a business travel technology company. 

“They want to know who you are and how to maybe use that to get into your other systems,” he said. “But they also want access to your payment information. Because they can steal your credit cards, etc.”

In the case of Scattered Spider, the cybercriminal group tends to focus on one sector at a time for a few weeks, said Charles Carmakal, the chief technology officer of Google-owned cybersecurity firm Mandiant, in a LinkedIn post on June 28. 

How Are Airlines Responding to the Attacks?

Qantas said it was currently contacting customers about the incident and is “putting additional security measures in place to further restrict access and strengthen system monitoring and detection.”

The carrier added that it notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and the Federal Police. Qantas said it would support these agencies in an investigation. 

Qantas also created a dedicated customer support line and said it would continue to share updates on social media and on its website. 

Alaska Air Group, the parent company of Hawaiian Airlines, said in a securities filing on June 27 that it “immediately took steps to safeguard Hawaiian’s operations and systems” and “engaged the relevant authorities and experts to assist in our investigation and ongoing remediation efforts.”

WestJet said it was working to safeguard its digital operations and support specialized teams working to resolve the incident. WestJet added that it is working with law enforcement on an investigation into the breach. 

Mandiant, which has been helping airlines with recovery, also published a set of guidelines for protecting IT systems against Scattered Spider attacks, according to CNN.