Hack those friendly skies

On July 19, 2024, cyber security firm CrowdStrike rolled out an update to its Falcon endpoint protection platform. These updates, in theory, allow the Falcon software to stay up to date on the latest threats and maintain smooth operation. In this instance, however, a flaw in the update caused many enterprise systems worldwide to effectively go offline.

Television news rooms went dark, point-of-sale systems turned off, and, in airports in Australia and around the world, check-in systems failed, with hundreds of flights delayed or cancelled. For instance, Jetstar’s cancellations doubled that month, rising from 153 the month before to 299 in July.

Figures released two months later by the Department of Transport’s Bureau of Infrastructure and Transport Research Economics (BITRE) also revealed, industry-wide, just 72.5 per cent of flights departed on time, compared to 77.8 per cent the prior month.

The incident laid bare the fragility of a deeply digital and interconnected system that was wholly unprepared for the sort of mass disruption that a real cyber attack on the aviation sector might cause. In fact, many cyber security experts both in Australia and abroad agreed that this was exactly what a cyber attack on the sector would look like if it did happen.

And then, a year-and-a-half later, that prediction came true.

The Collins Aerospace incident

In September 2025, a group of hackers calling themselves Everest targeted Collins Aerospace, a firm that, among other things, develops and supplies check-in and boarding software to a raft of airports across Europe. The hackers allegedly exfiltrated a large amount of data, including employee and passenger information, flight data, and network details.

But, more importantly for many travellers at the time, the attack caused the software vMUSE to go offline.

Heathrow Airport, Dublin Airport, Berlin Airport, and Brussels Airport all reported varying levels of disruption, with delayed and cancelled flights, and check-in staff forced to resort to pen-and-paper boarding passes. Recovery took up to a week.

“Work continues to resolve and recover from an outage of a Collins Aerospace airline system that impacted check-in. We apologise to those who have faced delays, but by working together with airlines, the vast majority of flights have continued to operate,” Heathrow Airport said a few days after the initial incident.

At the time, one cyber security expert said the incident was a wake-up call for the Australian aviation sector.

“The flight delays arising from the outage at Heathrow and other European airports for the electronic check-in and baggage drop show how technically interconnected flying is,” Professor of Practice Nigel Phair of Monash University’s Department of Software Systems and Cyber Security, said in the wake of the Collins Aerospace incident.

“It highlights the importance of third-party systems connecting airlines, airports and the IT integrators that keep operations running.

“While this hasn’t yet impacted any Australian airports, it demonstrates the need for Australian airlines to redouble their cyber security controls, especially after the recent Qantas data breach.”

In many ways, Qantas got off relatively lightly from its July 2025 data breach. About 6 million of the airline’s customers were affected by the incident, which resulted from a social engineering attack by a group of young, English-speaking hackers targeting a Qantas call centre in Manila. This is a larger dataset than that exposed by the Collins Aerospace, which saw only 1.5 million records compromised, sure, but Qantas did not experience any operational disruptions.

No flights were cancelled, no booking systems went offline, and passengers got where they were going. But the airline, and its rivals both at home and abroad, may not get off so lightly next time.

The growing threat

Airlines, airports, and the systems that support them are complex beasts, and as recent history has suggested, not particularly fail-ready when it comes to modern cyber threats.

“Airlines and airports are highly connected – this includes everything from ticket sales, seat bookings, flight planning, baggage handling and dispatch,” Phair recently told Australian Aviation.

“There are multiple third parties involved, which increases the threat surface and the use of significant data.”

These third parties could be as disparate as a check-in control system or a call centre running popular customer management systems. Distributed systems such as these may reduce overall overhead, but they also create weak points that the average aviation entity cannot afford to overlook.

“Airlines and airports can’t simply pause operations, so a cyber attack (or the threat thereof) is critical. Airlines also hold sensitive information, such as passenger details, loyalty data and credit card information,” Professor Phair said.

“It is also a sector very much in the public eye with significant media attention. As such, a ransomware group would see this as a good target for a quick and potentially lucrative payment.”

Ransomware groups – such as Everest and other cyber extortionists – use pressure tactics to coerce victims into paying potentially significant ransoms. In both the Qantas and Collins Aerospace hacks, the threat actors spent a lot of time negotiating with their victims, hoping for a payout in exchange for not sharing any stolen data online.

In both cases, neither victim paid a ransom, but that does not mean there were associated costs. Downtime and other disruptions can affect an organisation’s bottom line (a recent attack on Jaguar Land Rover caused a dip in the United Kingdom’s entire GDP!), while the risks of reputational damage and legal action are similarly very real – a class action against Qantas was launched within weeks of Qantas disclosing the incident.

However, ransomware is just one threat facing the aviation industry, as Rob Sharp, CEO of Airservices Australia, which provides traffic management, emergency services, and support services, explains.

“You hear of threats on customer information or private information, and then there’s ransomware – that’s not so much the threat we face,” Sharp said.

“It’s basically countries who are not friendly, who are wanting to disrupt airspace in Australia – and we’re not immune. The United States and others are also getting attacked. It’s actually rogue countries who are wanting to disrupt, and we regularly have attacks or attempts to infiltrate our systems.

“So, like every organisation, we have our crown jewels, core systems that have very, very tight security, and then it moves out to smaller and more remote locations. So it’s risk-managed. But basically, that is the nature of our cyber attacks. That’s the key risk.”

Sharp was rightly tight-lipped about the nations directly targeting the Australian aviation industry, but said that most people should be able to read between the lines. Without saying so, Chinese threat actors are likely a very real, though, for the meantime, passive threat. And they’re prone to use a range of tactics to insert themselves into their target networks, but one vector in particular worries Sharp.

“Having insiders in the organisation could even be a risk. Like every significant government organisation, you’re looking at physical controls, people accessing systems, and remote access through normal telecommunications attacks,” he said.

“We also have a number of data feeds that come in – we share a lot of data. If you go on flight tracking websites, you can see where aircraft are. A lot of that information is in the public arena. So it’s not so much information theft as disruption. And that occurs through vulnerabilities from physical right through to core systems.”

Work being done

Given the importance of the services Airservices Australia provides, securing them is a top priority. Like any other piece of critical infrastructure, Sharp takes cyber security seriously, though he does point out it’s a broader problem.

“Cyber security is not one thing. [We’re asking] ‘Are there controls over people accessing systems?’, ‘Do we train the culture of people?’ – and we’ve been doing that through audits, where we track people coming into buildings and actually question people coming in. It’s good behaviour,” Sharp said.

“From a systems perspective, we’ve been investing in more and more sophisticated tools that flag anomalies, [and] can automatically work with our suppliers such as Telstra to close off denial of service attacks. And we are also a leader in bringing stakeholders together. Aviation is not an island. There are many, many players.”

Sharp said Airservices is working closely with airlines, airports, and other technology teams to work through tabletop exercises to discover what can be improved and what vulnerabilities may lurk in any given aviation system. International forums are another important part of the cyber resilience puzzle that can provide real insights into the threats faced by the wider industry and how to face them.

“We’re seen as a global leader, particularly around the air traffic management side of things. We are very high calibre in cyber security, and obviously we work with the government agencies who work in this space, because we’re a national critical infrastructure,” he said.

“When you look at how important aviation is in Australia, it’s about a hundred million passengers now that travel around the network we’re responsible for. About $100 billion in annual economic activity. So if there’s a disruption to that, imagine the impact on the economy.”

“So for us it’s equivalent to turning off fuel supply or shutting down major businesses. We’re in that rare atmosphere where the impact is great because there’s a safety element, and aviation underpins travel in Australia. We’re a vast continent, and travel is very, very significant. So that’s the driver of the uniqueness.

“But it also means that because we don’t interface directly with the travelling public – airlines do that – the cyber risk is more about disruption to the economy.”

It’s that very real risk that adds such gravity to the situation, and Sharp treats the work of Airservices as a national asset.

“Our board takes it very seriously. We invest heavily in it. We’re well rehearsed in managing any attacks that do occur. And we liaise with the federal government regarding any significant activity so that, from a countrywide perspective, everyone’s aware.”

However, according to Phair, this work will never be complete – securing these systems is an ongoing process that requires deep collaboration.

“Like all of Australia’s national critical infrastructure, a lot has been done, particularly with the involvement of the Commonwealth government, to better prepare the sector against a cyber attack,” he said.

“That is not to say the sector is not immune, and we don’t know how many legacy systems are still in place.”

At the end of the day, the solutions that Airservices Australia and many other entities in the sector are seeking require a layered approach, and Phair has some salient advice for the wider industry.

“Take a multi-pronged approach of risk identification, analysis of threat intelligence and use of a competent compliance framework,” he said.

“The control framework which comes out of this analysis should be based on the maturity of the various players within the broader sector and their ability to implement and manage cyber risks.

“It is one of those ‘all boats rise on the tide’ scenarios where cross-sector intelligence and capability sharing will assist everyone.”