The Sky’s Darkest Blind Spot: Aviation Is Under Digital Siege—And the Defenders Are Retreating

Key Points :

• Aviation cyberattacks surged 131% between 2022 and 2023, with EASA documenting roughly 1,000 monthly airport attacks and a 600% spike in ransomware incidents between 2024 and 2025.
• The EU’s Part-IS regulation (Implementing Regulation 2023/203) takes effect in February 2026, mandating comprehensive cybersecurity frameworks for all aviation organizations operating in European airspace.
• The FAA is cutting its AI-powered cybersecurity research programs despite already-allocated funding—at the precise moment attackers are deploying AI-enhanced intrusion tools against the National Airspace System.
• Attackers now use deepfake audio, AI-generated phishing campaigns, and automated IoT exploitation tools purpose-built for aviation environments—a threat class that legacy firewalls and antivirus tools simply cannot counter.
• Cross-sector intelligence sharing through organizations like Aviation ISAC and EUROCONTROL’s EATM-CERT represents the most promising defensive paradigm, yet participation remains voluntary and unevenly distributed.

There’s an old joke among cybersecurity professionals: the only truly secure computer is one that’s turned off, unplugged, and locked in a vault. Try running an international airport that way.

Commercial aviation has spent the last two decades on a digital transformation binge—self-service kiosks, connected aircraft, real-time maintenance telemetry, cloud-based crew scheduling, IoT-saturated terminals. Modern aircraft carry over 100 interconnected computer systems, from flight management to entertainment platforms. Every one of those systems represents an attack surface. And in 2025, the attackers noticed.

What’s unfolding across the global aviation ecosystem isn’t just another chapter in the familiar cybersecurity cat-and-mouse game. It’s something structurally different: an industry whose entire operational model depends on digital connectivity finding itself overwhelmed by threat actors who are faster, more sophisticated, and better funded than the defenses arrayed against them. Worse, the regulatory response is fractured—with Europe pushing aggressive new mandates while the United States, paradoxically, slashes the very research programs designed to combat these threats.

A Thousand Attacks a Month—And Counting

The numbers are stark enough to warrant repetition. EASA’s Cyber Threat Intelligence team documented roughly 1,000 attacks targeting airports worldwide per month, with a staggering 600% increase in aviation-specific ransomware incidents between 2024 and 2025. Eurocontrol’s 2024 Cybersecurity Report showed that cyberattacks across the industry rose 131% between 2022 and 2023 alone, with a 74% cumulative increase since 2020.

But raw statistics obscure important structural shifts in how these attacks work and who’s behind them.

The threat landscape has bifurcated into two distinct categories. On one side sit financially motivated criminal enterprises—ransomware gangs, data brokers, and organized cybercrime syndicates running what amount to professional operations. The FBI has traced several major 2025 aviation breaches to Scattered Spider, the same group that crippled Las Vegas casino operations in 2023. On the other side are hacktivist collectives—Z-PENTEST Alliance, Noname057(16), Dark Storm Team—hitting Western aviation targets for geopolitical impact rather than profit. For them, airports provide irresistible visibility: grounded flights, blank departure boards, and stranded passengers make for compelling news footage.

Metric	Figure
Monthly airport cyberattacks (EASA estimate)	~1,000
Ransomware increase, 2024–2025	600%
Cyberattack increase, 2022–2023	131%
Major ransomware incidents (Jan 2024–Apr 2025)	27 incidents from 22 groups
Cost of 1 hour airport downtime (peak)	~$1 million
Dark web airline accounts detected (EATM-CERT)	15,493 from 30 airlines

The real-world consequences have been devastating. In March 2025, a DDoS attack from Dark Storm Team hammered Los Angeles International Airport, disrupting flight information displays, baggage handling, and electronic check-in. Screens went blank. Staff managed passenger flows manually. No flights were cancelled, technically—but the chaos was palpable. That same month, Kuala Lumpur International Airport suffered a ransomware attack so severe that staff resorted to writing departure times on whiteboards. Hackers demanded $10 million. Malaysian Prime Minister Anwar Ibrahim refused within seconds, declaring his country would never bow to criminal ultimatums—a bold stance that nonetheless left KLIA systems down for over 10 hours.

And then there’s the Qantas breach. In June 2025, attackers compromised a third-party platform used by the airline’s contact center, exposing the personal data of approximately 5.7 million customers. Air France and KLM lost customer data through separate customer service system breaches. Hawaiian Airlines dealt with IT infrastructure disruptions lasting weeks. The EATM-CERT had previously detected over 15,000 airline employee accounts from 30 carriers being sold on the dark web, valued at more than €400,000.

One incident, though, towers above the rest as a cautionary tale about interconnected risk. The July 2024 CrowdStrike outage wasn’t a cyberattack at all—it was a faulty software update from a cybersecurity firm that crashed 8.5 million Windows devices worldwide. Delta Air Lines, heavily reliant on both CrowdStrike and Microsoft, had to manually reset 40,000 servers. Over 7,000 flights were cancelled. 1.3 million passengers were affected. The airline pegged its losses at $550 million. That a cybersecurity company’s own update could inflict more damage than most actual attacks tells you everything about the fragility of aviation’s digital infrastructure.

AI: The Weapon That Cuts Both Ways

Here’s where the threat landscape gets genuinely alarming. Attackers aren’t just scaling up traditional methods—they’re deploying artificial intelligence to fundamentally change what’s possible.

AI-powered attack tools can now study aviation network patterns using machine learning, automatically exploit IoT vulnerabilities in smart airports, and launch sophisticated social engineering campaigns against aviation personnel. These aren’t theoretical capabilities described in white papers. They’re operational tools being used against real targets, right now. A single AI-powered attack platform can simultaneously target hundreds of aviation organizations, customizing its approach for each target—adjusting tactics when hitting an airport versus an airline operations center, optimizing techniques for each environment’s specific security architecture.

But perhaps the most unsettling development is the weaponization of deepfake technology against aviation operations. Voice and video deepfakes are being used to impersonate airline executives, ATC personnel, and maintenance staff. In the broader corporate world, the threat is already well-documented—a deepfake video call in 2024 tricked a finance employee at engineering firm Arup into authorizing $25.6 million in fraudulent transfers. In Q1 2025 alone, there were 179 recorded deepfake incidents globally, exceeding the total for all of 2024.

Now imagine that capability directed at aviation. A convincing deepfake of a maintenance manager authorizing an irregular procedure. A cloned voice of an operations director requesting emergency credentials. An AI-generated phishing email, personalized using data scraped from LinkedIn and airline HR systems, that’s virtually indistinguishable from the real thing. Click-through rates on AI-generated phishing emails already exceed 70%, according to industry data—making them nearly impossible to detect through human vigilance alone.

The irony is thick. The aviation industry is simultaneously trying to harness AI for safety-critical applications—predictive maintenance, flight optimization, anomaly detection—while defending against attackers who are deploying the same technology to dismantle its defenses. EASA’s own survey of aviation professionals found that two-thirds of respondents expressed reservations about at least one AI application scenario, with average acceptance ratings hovering at a cautious 4.4 out of 7.

Europe Pushes Forward: The Part-IS Revolution

Against this backdrop, the European Union has embarked on the most ambitious aviation cybersecurity regulatory initiative in history.

The regulatory package known as Part-IS—comprising Delegated Regulation (EU) 2022/1645 and Implementing Regulation (EU) 2023/203—introduces binding information security requirements across the entire EU civil aviation sector. Aerodrome operators, design organizations, and production organizations had to comply by October 16, 2025. The broader aviation ecosystem—maintenance organizations, air operators, training organizations, air navigation service providers, and the relevant oversight authorities including EASA itself—faces a February 22, 2026 deadline.

The scope is sweeping. Part-IS requires every covered organization to establish, implement, and maintain an Information Security Management System (ISMS) proportionate to its size, complexity, and risk exposure. This isn’t a checklist exercise. Organizations must conduct systematic risk assessments, develop incident response protocols, implement change management processes, and—critically—demonstrate that their cybersecurity measures are integrated into their safety management systems. Cybersecurity, in other words, is no longer an IT department concern. Under Part-IS, it becomes a board-level aviation safety obligation.

EASA and national authorities have adopted a pragmatic implementation model called PSOE—Present, Suitable, Operational, Effective. By February 2026, organizations need to reach at least “Present” and “Suitable” levels: defined roles, initial risk assessments, security policies, and incident management procedures in place. An additional 18-month grace period extends to achieving full operational effectiveness. It’s an acknowledgment that building a mature ISMS is a journey, not a switch flip.

Running in parallel, EASA’s AI Programme launched its first regulatory proposal in November 2025—NPA 2025-07—providing technical guidance on AI trustworthiness aligned with the EU AI Act. This framework specifically addresses how AI systems should be certified and overseen when used as safety components in aviation. It covers AI-based assistance (Level 1) and human-AI teaming (Level 2), with future extensions planned for reinforcement learning, generative AI, and hybrid systems.

The combined effect of Part-IS and the AI trustworthiness framework represents a regulatory paradigm shift. Europe is essentially declaring that in 21st-century aviation, information security is aviation safety—and AI governance is inseparable from both. Aviation analysts widely expect EASA’s framework to become the de facto global reference model, much as European aviation safety standards have historically shaped worldwide practices.

The American Paradox: Cutting Defenses While Threats Multiply

Which makes what’s happening across the Atlantic all the more baffling.

The FAA has been conducting Cybersecurity Data Sciences research since late 2021, exploring whether AI and machine learning algorithms can detect cyber intrusions targeting the National Airspace System in real time. The program partnered with Embry-Riddle Aeronautical University, MIT Lincoln Laboratory, and Astronautics Corporation of America—heavyweight institutions bringing expertise in aviation research, national security AI applications, and secure avionics systems. Total research funding reached nearly $3.8 million, with $1.3 million allocated to the current phase. The work had already yielded insights into differentiating normal network activity from potential cyber threats.

And then the FAA’s Aviation Safety Group moved to cut the programs. The stated rationale: budget constraints and shifting priorities. This despite funding already being allocated.

The timing is remarkable. At the exact moment when AI-powered attack tools are being deployed against aviation infrastructure worldwide, when EASA is building comprehensive regulatory frameworks to address precisely these threats, the FAA is dismantling its own research into AI-driven defense capabilities. The agency’s own research plan acknowledged the stakes clearly enough—a cyberattack on the NAS could have devastating consequences for aviation operations and safety, and traditional IT-based cybersecurity approaches don’t adequately address aviation’s unique constraints.

The cuts don’t exist in isolation, either. The FAA has simultaneously reduced its workforce, including critical safety analysts and support personnel. Eleven U.S. Senators, led by Mark Warner and Tim Kaine, formally demanded information about staffing reductions, noting that the agency should be analyzing near-miss data and reviewing staffing sufficiency—not cutting positions. A 20% decrease in program office leadership and acquisition staff has left even the contractor community uncertain about who to contact regarding massive pending procurements.

There’s a painful irony here. The FAA’s FY2026 budget request includes an additional $35 million to enhance cybersecurity—for replacing outdated equipment and modernizing data center infrastructure. Infrastructure spending is necessary, obviously. But infrastructure without intelligence is like building thicker castle walls while ignoring the tunnels being dug underneath them. What the aviation industry needs most urgently isn’t more firewalls—it’s the AI-driven monitoring and anomaly detection capabilities that the cancelled research programs were designed to develop.

The gap between European and American approaches is widening into a strategic chasm. EASA is building an integrated regulatory architecture that treats cybersecurity, AI governance, and aviation safety as a unified challenge. The FAA is requesting money for hardware upgrades while defunding the research that would make those upgrades meaningful.

The Defense Playbook: What’s Actually Working

If the threat landscape is dire and the regulatory response uneven, there are nonetheless bright spots in how the industry is organizing its defenses.

The Aviation Information Sharing and Analysis Center (Aviation ISAC), founded in 2014, has emerged as the nerve center of collective aviation cybersecurity intelligence. This global community—comprising airlines, airports, OEMs, IFE/satcom providers, and service companies across five continents—operates on a simple but powerful premise: threat intelligence shared in real time is worth exponentially more than intelligence hoarded. Members collaborate daily to prevent, detect, respond to, and remediate cyber risk. EUROCONTROL’s partnership with Aviation ISAC, announced in recent years, connects Europe’s air traffic management cyber team with the private sector’s frontline intelligence—sharing indicators of compromise, tactics and techniques, and lessons learned.

The technical defense architecture is evolving as well. Industry leaders are converging on several principles: zero-trust network architectures that assume every access point is a potential breach vector, requiring multi-factor authentication and micro-segmentation; real-time asset inventories covering all IT, operational technology, and IoT devices—from servers to security cameras to HVAC systems; and centralized analysis through Security Information and Event Management (SIEM) platforms paired with AI-driven anomaly detection.

Supply chain security has become an equally critical front. A 2024 SecurityScorecard report found that aviation-specific software vendors scored just 83 out of 100 on cybersecurity, revealing significant third-party risk. The Collins Aerospace ransomware attack in late 2024—which disrupted its MUSE check-in system and caused cascading delays at major European airports including Heathrow, Dublin, and Brussels—demonstrated how a single vendor compromise can ripple across the entire ecosystem. Part-IS explicitly addresses this through mandatory vendor risk assessments and contractual cybersecurity requirements.

And then there’s the most unglamorous but arguably most important defense: employee training. Recent breaches have overwhelmingly relied on social engineering—phishing, vishing, credential theft, impersonation. The Scattered Spider group’s 2025 campaign against North American and Australian carriers used techniques as straightforward as impersonating support staff and bypassing multi-factor authentication through social manipulation. Airbus has emphasized that employee awareness remains the single most important element in defense against cyber threats. When 71% of recorded aviation attacks involve stolen credentials and unauthorized access, the human firewall matters more than the digital one.

Where Do We Go from Here?

The aviation industry stands at an inflection point that will define its digital resilience for the next decade.

The threat trajectory is unambiguous. Ransomware and data extortion campaigns will intensify. AI-powered attacks will grow more sophisticated, adaptive, and difficult to detect. Deepfake technology will make social engineering attacks nearly indistinguishable from legitimate communications. The interconnected nature of aviation ecosystems means that any single point of failure—a vendor’s software, a contractor’s credentials, an airport’s IoT infrastructure—can cascade across airlines, airports, and air traffic control systems simultaneously.

The regulatory landscape, while uneven, is at least moving in the right direction on the European side. Part-IS represents a genuine paradigm shift in treating cybersecurity as a core aviation safety obligation rather than an IT afterthought. EASA’s AI trustworthiness framework has the potential to set global standards. The question is whether the rest of the world—particularly the United States—will converge toward similar frameworks or allow a dangerous regulatory gap to persist.

The global aviation cybersecurity market is projected to reach $8.42 billion by 2033. That figure sounds impressive until you consider that a single airport disruption during peak operations costs roughly $1 million per hour, that Delta alone lost $550 million from one software glitch, and that attackers are now running professional criminal enterprises with revenue models that would make some startups envious.

Perhaps the most haunting data point is also the simplest. Breaches caused by hacking or information leakage in global aviation systems increased from 4% in 2010 to 81% in 2024. In fifteen years, the industry went from peripheral cyber risk to near-total digital vulnerability. The question that should keep every aviation executive awake at night isn’t whether the next major attack is coming. It’s whether the industry’s defenses will be ready when it arrives—or whether we’ll be writing departure times on whiteboards again.

This article was produced in accordance with our editorial standards. Aviantics maintains strict editorial independence.