Swissport ransomware attack leads to flight delays
The attack is now 'under control' but raises questions around critical European businesses being targeted in recent weeks


Aviation services company Swissport announced it was the victim of a ransomware attack on Friday, with some flights forced into delays and other operations disrupted.
Neither the ransomware operator nor the type of ransomware used against the company is currently known, but the company reacted quickly to contain the attack, despite the disruption it caused.
"A part of Swissport’s IT infrastructure was subject to a ransomware attack," the company announced via Twitter on Friday. "The attack has been largely contained, and we are working actively to fully resolve the issue as quickly as possible. Swissport regrets any impact the incident has had on our service delivery."
At the time, its support website returned an error and was inaccessible, but a day later the company assured that the situation was under control and that affected systems were taken offline waiting to be restored from backups.
"IT security incident at Swissport contained. Affected infrastructure swiftly taken offline," it said on Saturday. "Manual workarounds or fallback systems secured operation at all times. Full system clean-up and restoration now underway. We apologise for any inconvenience."
"Due to system problems at our airport partner Swissport, 22 flights were delayed by 3 to 20 minutes yesterday," said a spokeswoman for Zurich Airport to Der Spiegel. Swissport told the publication that it was able to continue to provide ground services without full IT system access, though delays were inevitable.
Swissport provides ground services to airports such as passenger services, ramp and air cargo handling, fuelling, and executive hospitality services. In 2021, the company said it provided services to 97 million airline passengers and handled around 5 million tonnes of air freight at more than 100 cargo warehouses worldwide.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
The hack follows a number of widely reported cyber attacks on critical infrastructure across Europe last week, including attacks on oil facilities in Germany, Belgium, and the Netherlands, the BBC reported.
Experts speaking at the time said it was not currently clear if the attacks were linked or coordinated, but some experts have speculated the attacks may be linked to current political tensions between Russia and Ukraine, the latter of which has received widespread and prominent support from European and other western powers as a potential war looms.
RELATED RESOURCE
Vulnerability and patch management
Keep known vulnerabilities out of your IT infrastructure
"This is the third attack in a week on European critical infrastructure providers," said Andy Norton, European cyber risk officer at Armis to IT Pro. "The attacks have focussed on the ancillary IT services that surround the production system or service.
"The NIS legislation in Europe requires critical infrastructure providers to attain a certain level of operational resilience," he added. "Whether the surge in attacks is related to current geo-political events is unknown. However, providers of critical services should immediately review the adequacy of their risk assessments from cyber threat with emphasis on the criticality of the ancillary IT systems that have increased connectivity and the potential to impact the OT and ICS production and service delivery."

Connor Jones has been at the forefront of global cyber security news coverage for the past few years, breaking developments on major stories such as LockBit’s ransomware attack on Royal Mail International, and many others. He has also made sporadic appearances on the ITPro Podcast discussing topics from home desk setups all the way to hacking systems using prosthetic limbs. He has a master’s degree in Magazine Journalism from the University of Sheffield, and has previously written for the likes of Red Bull Esports and UNILAD tech during his career that started in 2015.
-
UK enterprises regret going all-in on public cloud
News Data sovereignty, rising costs, and governance issues mean many IT decision-makers regret having made the move
-
Trend Micro and Google Cloud double down on AI security with expanded partnership
News The agreement targets improved proactive security across cloud environments, alongside enhanced scam defense capabilities
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crime
News A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
-
Everything we know about the Ingram Micro cyber attack so far
News A cyber attack on Ingram Micro severely disrupted operations and has been claimed by the SafePay ransomware group.
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
News An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs