Cyber Attackers Are Targeting the Aviation Sector. How Should Air Traffic Controllers Respond?

Keeping aviation safe involves a complex ecosystem of stakeholders including aircraft manufacturers and airlines, airport authorities, air navigation service providers (ANSPs), cross-border network managers (such as EUROCONTROL in Europe), military air traffic control centres and national and international aviation authorities.

This safety-critical ecosystem is supported by a strong regulatory framework. At the international level, ICAO Annex 17 requires measures to protect critical systems and data, while in Europe, EASA Part-IS addresses cybersecurity risks that could affect aviation safety.

Every day, air traffic control (ATC) centres ensure that more than 100,000 aircraft, carrying up to 14 million passengers, take off and land safely. In Europe alone, EUROCONTROL manages 35,000 flights per day. In 2025, there were just eight fatal accidents from a total of 38.7 million flights.

Despite this strong safety record, aviation now faces a growing threat to its daily operations: cybercrime.

Until fairly recently, cyberattacks on the air travel sector were rare compared with verticals such as manufacturing and finance. However, this is changing.

Aviation cyberattacks up by 600 percent

According to Thales research, there were 27 major attacks by 22 ransomware groups on the aviation sector between January 2024 and April 2025. That’s a 600 percent increase in one year. In a sector where safety is the number one priority for everyone involved, this is a major concern. Each of these attacks could impact the critical systems that keep planes in the sky.

The cyber threat is coming from many directions. There are criminal organisations primarily motivated by financial gain. They steal sensitive data to achieve this goal. Meanwhile hacktivists and state-sponsored actors are more interested in disruption - often for political ends. They are more likely to carry out Distributed Denial of Service (DDoS) and ransomware attacks.

High-profile incidents are starting to make the news. In 2023, EUROCONTROL itself was targeted by the pro-Russian hacktivist group KillNet. It launched a distributed denial-of-service (DDoS) attack that temporarily disabled the EUROCONTROL website. The following year, hackers targeted Germany's air traffic control organisation the Deutsche Flugsicherung (DFS).

AI is changing the threat landscape

Specialised aviation protocols such as ASTERIX, used to exchange surveillance data between ATM systems, have traditionally required significant technical expertise to understand. Today, AI assistants can make complex technical documentation far more accessible and reduce the level of expertise needed to analyse specialised systems and protocols. For Air Navigation Service Providers (ANSPs), the implication is clear: obscurity can no longer be considered a meaningful line of defence. Security strategies should assume that potential attackers can understand the technologies and protocols on which ATM operations depend.

A sector built around safety

For many years, the aviation sector has recognised the need for strong segmentation between IT systems and critical operational technology (OT) systems. One example is the protection and segmentation of operational ATM systems, designed to limit exposure and prevent disruption to critical operations. Another is the use of fallback systems, enabling air traffic control centres to maintain operations in the event of a serious cyberattack.

Manual override is another important safety protection. It ensures controllers can take over from automated procedures at any time. And finally, there’s SOC oversight. This describes the ability of ATM operations to let security operations centres (SOCs) continuously monitor IT and OT systems for suspicious activity.

But air navigation service providers (ANSPs) must not be complacent. As with so many other verticals, a range of factors are starting to undermine their defence against a determined threat actor. They include:

• Ageing infrastructure. The sector’s legacy infrastructure can lack defensive protections such as encryption, segmentation, anti-virus protection and robust password policies.
• Authentication. Some systems lack mechanisms for verifying the integrity of exchanges between server components. There can also be challenges around accountability, particularly when cybersecurity requirements need to be balanced with operational safety requirements. For example, the Air Traffic Safety Electronics Personnel maintaining the ATM system might retain a machine’s default password because they don’t want to take the risk of modifying the configuration set up by the supplier.
• Centralised systems can be vulnerable to a single point of failure and insider threats.
• Lack of real-time threat detection, which delays the response to attacks.
• Routers with rules of segregation instead of a real firewall.

Connected networks grow the attack surface

Perhaps the biggest potential vulnerability to ANSPs comes from the increasing interconnectedness of ATM operations. Today’s systems comprise vast networks of linked components: ATC centres, control towers, navigation systems and aircraft. And these systems have to connect to external services such as satellite communications, weather centres, network managers (e.g.:  EUROCONTROL in Europe), suppliers, military air traffic control centres, maintenance suppliers, airlines and airports.

This complexity creates a larger attack surface, particularly where multiple suppliers, systems and external services need to interconnect. Also, vendors with different cybersecurity policies usually check only their own legal scope, which means no one is responsible for the whole chain. 

What makes this especially dangerous is that vulnerabilities can be greatest at the interface between two suppliers. For example, ATC might send an unauthenticated controller-pilot data link communication (CPDLC) message to a pilot. If each side expects the other to monitor the risk in this scenario, neither is protected. 

It's a similar story with the global navigation satellite system (GNSS). A hacker could spoof GNSS to send a false position to the aircraft - which later relays the same false data to ATC. In these newly interconnected aviation environments, even a manipulated USB device can contaminate multiple systems.

It is worth noting that, for now, ANSPs are not the prime focus of aviation cyberattacks. According to 2025 data from EUROCONTROL, hackers were five times more likely to target airlines than ANSPs. However, as aviation systems become more interconnected, it’s likely that an attack on one target will impact all the others. Everyone will be compromised.

So how should ANSPs navigate the growing cyber threat in this interconnected future? And which processes should they follow to become more resilient?

From regulation to resilience

For ANSPs, meeting regulatory requirements means translating them into continuous risk management. They need to assess their own operational environment and consider potential attack scenarios, distinguishing between cyber risks with operational consequences and those with safety impacts. This will help them identify critical systems, prioritise appropriate security measures and determine which residual risks need to be monitored.

In this interconnected environment, this process must be continuous. ANSPs need to regularly reassess threat scenarios and risks, detect and respond to incidents and adapt their security measures as systems, regulations, cyber threats and the geopolitical context evolve.

Threats to ATM are growing. The growing interconnectedness of aviation systems is widening the attack surface available to cyber attackers. 

In this climate, organisations across the aviation ecosystem need to conduct regular risk assessments and maintain effective response plans. They should review their security measures regularly to take into account changes to systems and networks, evolving regulations, new cyber threats and geopolitical context.

These regular reviews will enable ATM centres to keep risks under control, reassure their partners and meet the expectations of national and international regulators. 

To explore these cybersecurity challenges in greater depth and discover how ATM stakeholders can strengthen their cyber resilience, read our white paper, Cybersecurity Challenges in Air Traffic Management.