Aeroflot’s July Cyberattack Likely Stemmed from Supply-Chain Breach via Bakka Soft In late July, Russia’s flagship airline, Aeroflot, suffered a major cyberattack that disrupted operations and grounded dozens of flights. The Kremlin acknowledged the incident, while two hacktivist groups—Ukrainian-linked Silent Crow and Belarusian Cyberpartisans—claimed responsibility. New reporting from Russian outlet The Bell suggests the attack was a supply-chain breach, originating from Bakka Soft, a Moscow-based software developer with access to Aeroflot’s IT network. The company had worked on the airline’s iOS apps and quality management systems. According to sources close to the investigation, attackers exploited a vulnerability left unaddressed since January, when suspicious activity was first detected. Aeroflot reportedly failed to implement two-factor authentication (2FA) or revoke Bakka Soft’s access, allowing attackers to deploy over two dozen malware tools and establish persistence. The attack led to over 100 canceled flights, tens of thousands of stranded passengers, and direct losses of at least $3.3 million. Total damages are estimated in the tens of millions. Neither Bakka Soft nor the hacktivist groups have confirmed the breach method. The Bell’s report remains unverified, and the outlet—founded in 2017 by Russian journalists—has been labeled a "foreign agent" by the Russian government, complicating independent validation. The designation imposes legal and operational restrictions, often targeting media critical of the state.