INDUSTRY FACT FILE · AVIATION & AEROSPACE

Threat Landscape: Top Cyber Threats Facing Aviation and Aerospace

The 18 most relevant cyber threats, attacks and industry challenges for airlines, airport operators, handlers, MRO firms and aerospace manufacturers, and the impact each one has on operations, passengers and partners.

Aviation attracts ransomware groups because stopped aircraft, stranded passengers and missed slots create visible, expensive pressure; it attracts data thieves because passenger records contain passports, dates of birth and travel patterns; it attracts fraudsters because loyalty miles and refunds are cash equivalents; and it attracts state actors because airports, air navigation and aerospace manufacturers are critical infrastructure with valuable designs. The attack surface is unusually interdependent: shared platforms, thousands of suppliers with access, OT across every terminal and connected aircraft.

Landmark incidents show the pattern. SITA (2021) exposed about 4.5 million Air India passengers' data from a provider; SpiceJet (2022) delayed flights after ransomware; the Port of Seattle (2024) lost check-in, baggage and displays to Rhysida ransomware and later notified about 90,000 people; Qantas (2025) lost 5.7 million customers' data through a contact-centre platform; Collins Aerospace's MUSE disruption (2025) stopped electronic check-in at Heathrow, Brussels and Berlin; and LockBit leaked about 43 GB of Boeing data (2023) after a US$200 million demand. Verizon's 2025 DBIR found third-party involvement in 30% of breaches—a ratio aviation's provider model makes easy to believe.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by aviation segment (Codec Networks assessment).

4.1 Ransomware and the airport operation

Airports are OT environments with IT front doors. A phished account becomes domain compromise, and ransomware then reaches baggage servers, BMS and access control on flat networks—as the Port of Seattle experienced in 2024 when kiosks, baggage and displays failed together.

• Questions to test: Which airport operations depend on which systems? Are baggage, BMS and access control segmented from office IT? Are PLC programs and configurations backed up? Would EDR and the SOC catch domain compromise before encryption?
• Relevant services: airport IT/OT assessment, segmentation design, backup and restore testing, EDR validation, crisis exercises.

4.2 Shared platforms and manual fallback

Common-use check-in, departure control and messaging providers serve many airlines and airports at once; when one is disrupted, as Collins Aerospace's MUSE was in September 2025, every counter goes manual. Resilience is a contract and a rehearsal, not a product.

• Questions to test: Which providers could stop our operation? Have we assessed them and agreed recovery and notification duties? Can we check in, tag bags and board manually for a day—and have we rehearsed it with airlines and handlers?
• Relevant services: platform provider risk assessment, contract clauses, dependency mapping, fallback rehearsal, joint exercises.

4.3 Passenger data at the provider

The largest aviation breaches—SITA in 2021, Qantas's contact-centre platform in 2025—happened at providers holding airline data. Passport numbers and dates of birth cannot be reset, and the DPDP Act will add breach-intimation duties on top of CERT-In's six-hour reporting.

• Questions to test: Where is every copy of passenger data—PSS, loyalty, contact centres, handlers, analytics? Which processors hold passports? Are retention limits enforced? Would we learn of a provider breach in hours, and could we report in six?
• Relevant services: processor assessments, data mapping and minimisation, DPDP programme, notification clauses, breach workflow.

4.4 Suppliers from handlers to aerospace tiers

Aviation runs on thousands of suppliers with access, data or operational dependencies: handlers on airport systems, caterers at the aircraft door, IT vendors in baggage halls, tier suppliers holding OEM designs. Boeing's 2023 LockBit incident and Expeditors-style outages show how supplier incidents become everyone's problem.

• Questions to test: Which suppliers hold access to our systems or our data? Are they tiered and assessed? Is access brokered with MFA and least privilege? Do contracts require notification and security evidence?
• Relevant services: supplier and platform assurance programme, brokered vendor access, contract clauses, OEM and Part-IS readiness.

4.5 Loyalty, apps and the 6-hour clock

Loyalty programmes hold stored value behind consumer-grade authentication, and airline apps expose booking and payment logic at scale. Attacks on them are high-volume and fast, and CERT-In expects detection and reporting within six hours.

• Questions to test: Do login and redemption flows resist credential stuffing? Is step-up authentication required before miles leave an account? Are apps and APIs tested after every release? Does the SOC see fraud and security signals together?
• Relevant services: ATO and business-logic testing, loyalty platform and API testing, step-up authentication design, fraud-aware SOC monitoring, incident playbooks.

• CERT-In: incidents reported within six hours of noticing them; logs available for investigation.
• DGCA and BCAS: incidents affecting safety or security systems engage aviation regulators under the national programmes.
• NCIIPC: incidents affecting notified transport systems require coordination.
• SEBI LODR: listed airlines and airport companies disclose cyber incidents and data loss in the quarterly corporate governance report.
• DPDP: incidents involving passenger, crew or member personal data trigger breach intimation once provisions commence in May 2027.
• EASA Part-IS and partners: EU-approved organisations report information security incidents under Part-IS; alliance, lessor, insurer and OEM contracts require notification and evidence.

• If our check-in or departure control platform went dark tonight, could we board tomorrow—and have we rehearsed it?
• Which provider, handler or supplier could stop our operation or leak our passengers' data, and have we assessed them?
• Are baggage, BMS, access control and CCTV segmented from office IT and from vendors?
• Where is every copy of our passenger data, and which processors hold passports?
• Could an attacker replay leaked passwords against our loyalty programme tonight?
• Could we detect, contain and report an incident within six hours while keeping aircraft and passengers moving safely?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events and company disclosures.