Ukrainian Hackers Hit Russian Airline Passenger System, Delay Flights

A Distributed Denial of Service (DDoS) attack on Russia’s airline booking system has caused flight delays across multiple air carriers.

The Leonardo reservation system describes itself as a solution that “enables airlines to maximize bookings and optimize revenue through all distribution channels by providing easy tools to make reservation with ancillary services.”

Following Russia’s invasion of Ukraine and the introduction of anti-Russia sanctions, all the country’s airlines switched to domestic systems to process air transportation. Leonardo is used by 50 Russian air carriers, with a total of about 45 million passengers per year, according to the Russian news agency Interfax.

The Ukrainian hacktivist group IT Army knew this, so they flooded the company’s booking portal with web traffic in a typical DDoS attack, taking down the service and causing massive disruption across multiple air carriers.

The Record reports that the incident lasted about an hour, delaying flights at Aeroflot, Rossiya Airlines and low-cost carrier Pobeda.

Taking responsibility for the hack, the group wrote on Telegram:

While you're sipping your artisanal latte, our "noble" neighbors to the north are stuck in queues, trying to book flights. Apparently, their "Leonardo" system (which sounds more like a Teenage Mutant Ninja Turtle than a genius inventor) is under attack from "abroad." So, customers of "Pobeda" and "Aeroflot" can neither book nor check in for flights.

Rostec, one of Leonardo’s developers, acknowledged the hack, adding that it constantly suffers "large-scale” attacks, including at least five in September alone.

“It's clear that there's an actual cyberwar waged against Russia. Its goal is to damage the Russian IT infrastructure and disrupt the work of the most important industries,” Rostec said in a statement.

Before the introduction of sanctions, most Russian airlines used foreign reservation systems, Interfax noted.

Flagship carrier Aeroflot said yesterday it was “taking measures to quickly restore the normal operation of the system.”

Pobeda issued a similar statement responding to the incident, urging passengers to “arrive at the airport in advance.”

Last week, Crimean authorities said their entire internet infrastructure was attacked by hackers, causing outages on the peninsula, with multiple internet providers affected at once.