Aeroflot

The 2025 cyberattack on Russia's flag carrier (July 28, 2025) was claimed by hacktivist groups Silent Crow and Belarus Cyber-Partisans, who said they had a year of network access, copied customer and internal data and destroyed systems; it forced more than 100 flight cancellations. The attackers' claims were not independently verified, but the incident was both disruptive and, by their account, a data theft. Aeroflot is also the row where consumer recourse is most theoretical. Sanctions, state ownership and the absence of an independent data protection authority mean the terms a passenger accepts are effectively unenforceable by that passenger.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Not independently confirmed this pass; as a Russian carrier operating under Russian jurisdiction, typical US/EU consumer-protection frameworks (GDPR, US arbitration law) do not straightforwardly apply.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.