Ransomware attack disrupts Spicejet flights
HT Correspondent
NEW DELHI: Domestic airline Spicejet said on Wednesday it was the target of an “attempted ransomware attack” before its flight operations were disrupted for most part of the day, leaving many stranded at airports and inside aircraft with delays stretching to over four hours.
The airline did not give details of the cyberattack but appeared to have at first suggested that it had regained control of its computer systems in the morning, before adding in an update in the afternoon that it was still dealing with a “cascading effect”.
“Certain Spicejet systems faced an attempted ransomware attack last night that has impacted our flight operations. While our IT team has to a large extent contained and rectified the situation, this has had a cascading effect on our flights leading to delays,” the company said on Twitter in an update at 3pm, adding that it was “in touch with experts and cyber crime authorities on the issue”.
Earlier, at 8:30am, it had said that the “IT team has contained and rectified the situation” and “flights are operating normally now”.
The morning tweet triggered a backlash from the airline’s passengers, many of whom posted photos from inside planes purportedly held on the tarmac for several hours. “No, things are not normal. Our flight was delayed since morning and we are still stuck. Poor communication and handling from Spicejet. They just keep increasing the time in 30 min chunks to 5 hours delay now. Response we get is waiting for papers,” said one
Twitter user in response to the tweet at 2:30pm.
“The flights are NOT operating normally! The Delhi Dharamshala flight is still stranded on the runway since 6am! I have a sick child with me, making this wait extremely difficult. There is no update on when the flight will take off or whether it will take off or not!” wrote another user at 10am.
A company spokesperson said there were no estimates yet on how many flights were affected but the cascading impact meant flight to smaller airports without night landing facilities had to be cancelled after they were delayed.
A ransomware attack typically involves systems being encrypted, leaving users virtually locked out of the machines. Such an incident generally begins from a cluster of devices before the infection spreads and mitigation measures therefore require isolating the infection, which could involve shutting down large parts of a network.