Security for Aviation: the anatomy of a ransomware attack that freezes check-in
Airlines and airports run check-in, baggage, navigation, and critical OT systems with extremely high visibility and operational impact. Decripte detects lateral movement before detonation, contains ransomware in under 1h, and builds redundancy, OT/IT segmentation, and continuous monitoring so a frozen operation can get flying again.
Direct answer
Protecting an airline or an airport requires combining four fronts that work together: a SOC monitoring 24/7 the telemetry of check-in systems (DCS), baggage (BHS), ticketing, and airport OT environments, able to flag lateral movement and initial encryption before mass detonation; an incident response capability with a containment SLA of up to 1 hour, able to isolate network segments, cut off propagation, and activate continuity plans before flights are affected; a defense architecture that rigorously segments corporate IT, passenger systems, and OT (baggage belts, jet bridges, apron systems), with redundancy and tested immutable offline backups; and recurring pentesting that validates these barriers the way a real attacker would. On top of this foundation, compliance with LGPD/ANPD (passenger data), PCI DSS (card ticketing), and civil aviation requirements stops being paperwork and becomes a verifiable technical control. Decripte delivers this whole set as a managed service, with a free exposure assessment at decripte.com.br/intelligence-center.
24/7
SOC monitoring check-in, baggage, and OT
<=1h
Ransomware containment SLA
LGPD
Passenger data under the ANPD
PCI DSS
Requirement for card ticketing
In summary
- ›Aviation is a high-value target because the impact is immediate and visible: lines, delayed flights, and national headlines increase the pressure to pay ransom in hours, not days.
- ›Ransomware almost never detonates at the moment of intrusion: there is a window of days to weeks of reconnaissance and lateral movement. Whoever monitors 24/7 detects the attacker before mass encryption.
- ›The most underestimated risk is the bridge between corporate IT and airport OT (baggage belts, jet bridges, apron systems). Without segmentation, a phishing email reaches the operations floor.
- ›A backup is only useful if it is offline, immutable, and tested. Modern ransomware seeks out and deletes online backups before detonating to force payment.
- ›Operational resilience is worth more than perfect prevention: the goal is to keep check-in running in degraded mode while Decripte eradicates the threat and restores the environment.
Cibersegurança para Aviation and Airports
Airlines and airports run check-in, baggage, navigation, and critical OT systems with extremely high visibility and operational impact. Decripte detects lateral movement before detonation, contains ransomware in under 1h, and builds redundancy, OT/IT segmentation, and continuous monitoring so a frozen operation can get flying again.
Why aviation is a priority target for ransomware and fraud
Few sectors combine as many attacker-drawing factors as aviation. Airlines and airports run extremely high-visibility services with virtually zero downtime tolerance: a check-in system going offline doesn't just cause financial loss, it creates lines that become national headlines within minutes, passengers missing international connections, and a chain reaction that ripples across the entire flight network. This operational pressure is exactly what a ransomware group exploits — the more painful the downtime, the greater the chance the victim pays the ransom quickly.
Beyond extortion through unavailability, the sector concentrates valuable data. Passenger name records (PNR) bring together full name, ID document, itinerary, contact, and often payment data — a rich set for fraud and for extortion through leaks. Frequent-flyer programs work like a liquid parallel currency, a constant target for account takeover and resale on underground markets. And ticketing that processes cards brings the classic financial fraud surface, with associated PCI DSS requirements.
The IT-OT link is the blind spot
Most aviation security plans focus on corporate IT and passenger systems. But the most alarming surface is operational technology (OT): baggage handling belts (BHS), jet bridges, apron systems, HVAC, and power. When these networks share a path with IT, a phishing email in the administrative area can, through lateral movement, reach the operations floor. Segmenting IT, the passenger environment, and OT is the most important barrier and the one most often absent.
The five threats that hit the sector most
From ransomware shutdowns to OT compromise
Priority vectors in airlines and airports
- ✓Ransomware paralyzing operations — encryption of DCS (check-in), email, dispatch systems, and ticketing, with the operation frozen and pressure to pay within hours.
- ✓Passenger data leak — exfiltration of PNR (name, ID document, itinerary, payment) used for double extortion and exposed to ANPD sanctions under the LGPD.
- ✓Attacks on check-in and baggage systems — manipulation or unavailability of the DCS and BHS, which freeze boarding and misroute or lose baggage.
- ✓Miles and ticketing fraud — account takeover of loyalty programs, fraudulent redemption of miles, and card fraud in ticket issuance.
- ✓Airport OT compromise — reaching jet bridges, belts, power, and apron systems from the corporate network, with operational and physical safety risk.
These five vectors rarely appear in isolation. The pattern observed in the sector is a chain: an initial phishing email gains a foothold in corporate IT; the attacker collects credentials and moves laterally; identifies and exfiltrates the passenger database to secure extortion leverage; locates and destroys online backups; and only then detonates the ransomware over the most time-sensitive systems, such as check-in. Defense must therefore break the chain at several points — not just block the initial email.
Is aviation and airports data already exposed or up for sale? Find out now — for free.
Sem cartão, sem compromisso. Descubra em minutos o que já vazou da sua empresa e qual é o seu risco real.
The defense window: detect before detonation
The most common mental error is treating ransomware as an instantaneous event. In practice, from the initial intrusion to mass encryption there is usually a window of days to weeks in which the attacker conducts reconnaissance, escalates privileges, maps the environment, and prepares the ground. That window is the defense opportunity. A SOC that monitors 24/7 sees the signals of this phase: anomalous authentications, execution of network discovery tools, creation of privileged accounts, unusual access to backup servers, and attempts to disable antivirus and logs.
What the SOC monitors in airline operations
Login and privilege telemetry across check-in and dispatch systems; network behavior between the IT, passenger, and OT segments; access to PNR repositories and backup servers; the integrity of ticketing systems (PCI DSS); and indicators of command and control and of initial encryption. The goal is to flag the preparation phase, not just the completed damage.
When detection happens within this window, containment is surgical: the compromised machine or segment is isolated, credentials are revoked, and the operation continues as normal. When detection fails and encryption has already begun, the game shifts to resilience — containing propagation, keeping check-in running in degraded mode, and restoring from immutable backups. Both scenarios require prior preparation; neither can be improvised in the middle of the incident.
Anatomy of ransomware at check-in
Anonymized real-world example (not an actual client)
The following section describes the anatomy of a typical sector incident — an anonymized real-world example built to show how the response works in practice, not the description of an actual client. The details reflect real attack and containment patterns observed in aviation environments.
The trigger is usually mundane: a fake-invoice email opens a command-and-control session on an administrative workstation. From there, the attacker spends days invisible — mapping Active Directory, collecting password hashes, identifying where the passenger database lives and where the backups are. Only once the environment is under control and the online backups are neutralized does it fire off the encryption, deliberately at peak check-in time, to maximize the pain and the pressure to pay.
Decripte's objective in the incident
It is not just to remove the malware. It is to keep the airline operation running — even in degraded mode, with manual check-in and contingency — while the threat is eradicated and the environment is restored from trusted copies, without reinfection and without giving in to extortion.
Segmentation, redundancy, and immutable backup
The architecture that decides whether the operation stops or continues
The difference between a scare and a days-long shutdown lies in the architecture defined before the attack. Three decisions dominate the outcome. The first is segmentation: corporate IT, passenger systems (check-in, ticketing), and airport OT must live in distinct network zones, with firewalls and flow control between them, so that the compromise of one zone does not reach the others. The second is redundancy of critical passenger systems, with the ability to operate in degraded mode and contingency check-in procedures ready and drilled.
The resilience pillars Decripte validates
- ✓Effective segmentation between IT, passenger systems, and OT, with minimal, monitored flow rules.
- ✓Offline, immutable backups (3-2-1 rule), out of reach of production credentials, with restoration tested periodically.
- ✓Redundancy and degraded mode for check-in and dispatch, with drilled contingency procedures.
- ✓Strong authentication (MFA) and privileged identity management, closing the path most used for lateral movement.
- ✓A written incident response plan, with roles, communication, and decision triggers defined before the incident.
The third decision, and the most neglected, is the immutable backup. Modern ransomware actively seeks out online backups and deletes them before detonating, precisely to take away the victim's option to restore and to force payment. Backups that are worth anything are offline or immutable, isolated from production credentials, and — the point that fails most often — restored in tests regularly. A backup that has never been tested is not a backup; it is a hope.
What would an incident in aviation and airports cost? See your real risk before it happens.
Sem cartão, sem compromisso. Descubra em minutos o que já vazou da sua empresa e qual é o seu risco real.
Compliance as a technical control, not paperwork
The aviation sector carries a dense set of obligations. Passenger data is personal data under the LGPD, with ANPD oversight and a duty to notify in the event of an incident that creates risk. Ticketing that processes cards is subject to PCI DSS. And the operation falls within the civil aviation framework and critical infrastructure protection, with growing cybersecurity governance expectations.
What changes when compliance becomes a control
Decripte translates regulatory requirements into auditable technical controls: segmentation verified by pentest, encryption and key management, log recording and retention, MFA, vulnerability management with deadlines, and a response plan that meets the duty to notify the ANPD within the legal timeframe. The goal is for an audit to find controls working, not policy filed away.
Treating compliance this way has a valuable side effect: the same investment that satisfies the regulator is what actually reduces risk. Segmenting for PCI DSS is what stops phishing from reaching OT. Recording and retaining logs for the LGPD is what gives the SOC the telemetry to detect the attacker. Compliance and real security stop being competing budget line items.
How Decripte works in the sector
Decripte operates in two complementary modes. The first is continuous operation: the 24/7 SOC monitors critical systems and the OT environment, vulnerability management keeps the surface under control, and recurring pentesting validates the barriers the way an adversary would. The second is incident response under SLA, actionable at any hour, which springs into action the moment the anomalous signal appears.
The managed service model matters especially in aviation because the operation does not stop to defend itself: check-in runs 24 hours a day, the flight network has no comfortable maintenance window, and the internal team rarely has the bandwidth to hunt threats in the middle of the night. Decripte takes on this continuous watch and delivers the ready response capability, so the airline's team can focus on flying while security operates in parallel.
Start with a free assessment
Before any contract, Decripte offers a free exposure assessment at decripte.com.br/intelligence-center, which maps the external surface visible to an attacker. To set up SOC, incident response, pentest, and compliance, sign-up is self-service at decripte.io/start, and the technical conversation happens at decripte.io/contato.
Anatomy of a ransomware attack that freezes an airline's check-in
Real, de-identified example
Anonymized real-world example (not an actual client), built from real attack and containment patterns in aviation. A mid-sized airline runs integrated check-in (DCS), ticketing, and dispatch, with the corporate IT network connected — without rigid segmentation — to passenger systems and part of the airport OT. Backups are made daily but stored in an online repository accessible with production credentials. The attack's objective is classic: paralyze the operation at peak and demand ransom.
D-14 — Initial foothold
A fake-invoice email is opened by an administrative employee. A command-and-control beacon establishes itself on a workstation in corporate IT. Nothing breaks; the operation continues as normal and the intruder stays invisible, beginning reconnaissance of the environment.
D-3 — Lateral movement detection
Decripte's 24/7 SOC flags the anomalous pattern: network discovery attempts, creation of a privileged account after hours, and unusual access to the backup server. The alert is correlated and elevated to an incident within minutes. The window before detonation is the defense opportunity.
Hour 0 — Containment (SLA <=1h)
The response team isolates the compromised segments, revokes the collected credentials, takes down the C2 channel, and blocks the path between corporate IT, passenger systems, and OT. Propagation is halted before the check-in DCS is reached.
Hours 1-8 — Eradication
Threat hunting across the entire environment: identification of all persistence (scheduled tasks, ghost accounts, implants), removal, and closing of the exploited vulnerabilities. It is confirmed that the intruder reached neither the immutable backups nor the OT segment.
Hours 8-24 — Recovery
The few systems touched are restored from a validated immutable backup. Check-in operates in contingency mode during the critical window, with no flight cancellations. The operation returns to normal without paying ransom and without completed exfiltration of the passenger database.
Following week — Lessons and hardening
Formal post-incident: implementation of rigid IT/passenger/OT segmentation, migration of backups to an immutable, offline repository, MFA on all privileged access, and tuning of the SOC's detection rules to the observed pattern. Pentest validates the new barriers.
Outcome with Decripte
Because the threat was detected in the preparation phase, containment occurred within the up-to-1-hour SLA and check-in was never encrypted. No ransom was paid, no PNR leak was completed, and no flight was canceled. The incident becomes an input: the architecture of segmentation, immutable backup, and continuous monitoring now prevents the next phishing email from getting anywhere near the operation. That is the result Decripte pursues — not perfect prevention, but the resilience that keeps the airline flying while the threat is eradicated.
Don’t wait for the incident. Start hardening aviation and airports today.
Comece pelo diagnóstico gratuito agora e veja em minutos o que já vazou. SOC 24x7 e contenção em até 1h nos planos pagos.
How Decripte responds to an incident in aviation
Decripte's incident response is a disciplined process, actionable 24/7, designed for the context in which every minute of frozen check-in has operational and reputational cost. The flow below is what springs into action as soon as the anomalous signal appears.
- Detection and triage: the 24/7 SOC correlates check-in, ticketing, identity, and OT telemetry, elevates the event to an incident, and classifies severity and scope within minutes.
- Containment under SLA (up to 1h): isolation of compromised segments and machines, credential revocation, cutting off command and control, and blocking the path between IT, passenger systems, and OT, to halt propagation before mass detonation.
- Continuity activation: triggering degraded-mode and contingency check-in procedures, to keep the airline operation running while the threat is handled.
- Eradication: threat hunting across the entire environment, removal of all persistence, and closing of the exploited vulnerabilities, with confirmation that backups and OT remain intact.
- Recovery: restoration from validated immutable backups, with integrity verification and a controlled return of systems to production, without reinfection.
- Regulatory duty: assessment of the incident against the LGPD and PCI DSS, and support for notifying the ANPD within the legal timeframe when there is risk to passenger data.
- Post-incident and hardening: root-cause report, lessons learned, and implementation of structural fixes (segmentation, immutable backup, MFA, detection rules).
- Validation: targeted pentest to confirm that the corrected barriers withstand a real adversary before closing the case.
How Decripte structures security for airlines and airports
Responding well to an incident is half the work. The other half is the architecture built beforehand, which decides whether the next attack becomes a contained scare or a shutdown. Decripte structures the sector's security on mutually reinforcing pillars.
Continuous 24/7 monitoring
SOC operating uninterrupted over check-in, ticketing, identity, and OT, with detection rules tuned to the sector's attack pattern, to flag lateral movement in the window before detonation.
IT / passenger / OT segmentation
Rigid separation between the corporate network, passenger systems, and airport operational technology, with minimal, monitored flow control, preventing a phishing email from reaching the operations floor.
Resilience and immutable backup
Offline, immutable backups (3-2-1) out of reach of production credentials, restoration tested regularly, and degraded mode for critical passenger systems.
Identity and vulnerability management
MFA and privileged access management closing the path most used for escalation, combined with a continuous cycle of vulnerability identification and remediation with deadlines.
Recurring pentest
Periodic adversarial validation of the barriers — segmentation, authentication, external exposure, and ticketing and loyalty APIs — testing how a real attacker would exploit the operation.
Verifiable compliance
Translation of LGPD/ANPD, PCI DSS, and civil aviation requirements into auditable technical controls, so that the same structure that satisfies the regulator reduces real risk.
Recommended plans for Aviation and Airports
24/7 SOC
Uninterrupted monitoring of check-in, baggage, ticketing, and OT to detect ransomware lateral movement in the window before detonation, when containment is still surgical.
See plan →Incident Response
Containment SLA of up to 1 hour to isolate segments, activate continuity, and keep the airline operation flying in degraded mode while the threat is eradicated, without giving in to extortion.
See plan →Pentest
Recurring adversarial validation of IT/passenger/OT segmentation and of ticketing and miles APIs, confirming that the barriers withstand a real attacker.
See plan →Compliance
Structuring LGPD/ANPD (passenger data) and PCI DSS (ticketing) as auditable technical controls, aligned with civil aviation cybersecurity expectations.
See plan →Frequently asked questions
How long does Decripte take to contain ransomware in our check-in?
Decripte's containment SLA is up to 1 hour from activation. In practice, when the 24/7 SOC detects lateral movement in the preparation phase — before mass encryption — containment is even faster and more surgical, isolating the compromised segment without affecting the operation. The sooner the threat is detected, the smaller the impact.
Can you keep check-in running during an attack?
That is the central objective of our approach. Alongside containment, Decripte activates the degraded-mode and contingency check-in procedures, structured before the incident, to keep the airline operation running while the threat is eradicated and the environment is restored from trusted backups. Operational resilience weighs more than perfect prevention.
Our IT network is connected to airport OT. Is that a problem?
It is the sector's most underestimated risk. Without rigid segmentation, a phishing email in corporate IT can, through lateral movement, reach baggage belts, jet bridges, and apron systems. Decripte structures the separation between IT, passenger systems, and OT with monitored flow control and validates that barrier by pentest. It is the highest-impact fix we recommend.
How does Decripte protect passenger data (PNR)?
Passenger data is personal data under the LGPD, with ANPD oversight. Decripte protects the PNR repository with access monitoring, encryption, key management, and log recording, and structures the response plan to meet the duty to notify the ANPD within the legal timeframe should an incident create risk to data subjects. The focus is preventing the exfiltration that feeds double extortion.
Do we need PCI DSS for ticketing? Do you help with that?
Yes. Ticketing that processes card data is subject to PCI DSS. Decripte helps translate that requirement into auditable technical controls — segmentation of the card environment, encryption, strong authentication, log recording, and vulnerability management — so that an audit finds controls working, not policy filed away.
Do our backups protect us against ransomware?
Only if they are offline or immutable, isolated from production credentials, and tested regularly. Modern ransomware seeks out and deletes online backups before detonating, precisely to force payment. Decripte assesses your backup strategy, migrates to an immutable model (3-2-1), and validates restoration in tests. A backup that has never been restored is not a backup.
How do I start working with Decripte?
The no-commitment starting point is the free exposure assessment at decripte.com.br/intelligence-center, which maps the external surface visible to an attacker. To set up 24/7 SOC, incident response, pentest, and compliance, sign-up is self-service at decripte.io/start. For a technical conversation about your environment, use decripte.io/contato.
Do you serve both airlines and airports?
Yes. The surfaces overlap (check-in, baggage, passenger data, OT) and differ, and Decripte adapts the design — segmentation, monitoring, and response — to the profile of each operation, whether an airline, an airport operator, or a ground services provider.
Sector terms
- DCS (Departure Control System)
- Departure control system that runs check-in, boarding pass issuance, and passenger and baggage dispatch. It is one of the most time-sensitive systems in an airline: when it stops, boarding stops.
- BHS (Baggage Handling System)
- The airport's baggage handling system — the belts and automation that sort and route bags. It is an OT environment that, if reached by an attack, can freeze or misroute baggage at scale.
- OT (Operational Technology)
- The set of systems that control the airport's physical processes: belts, jet bridges, power, HVAC, and apron systems. Unlike corporate IT, it requires its own segmentation because of its operational and physical safety impact.
- PNR (Passenger Name Record)
- Passenger record that brings together name, ID document, itinerary, contact, and often payment data. It is personal data under the LGPD and a valuable target for fraud and extortion through leaks.
- Immutable backup (3-2-1)
- A backup strategy with three copies, on two types of media, one of them offline or immutable and isolated from production credentials. It prevents ransomware from deleting the copies before detonating, preserving the option to restore without paying ransom.
- Lateral movement
- A technique in which the attacker, after initial access, moves from machine to machine within the network to escalate privileges and reach the target assets. Detecting it is the opportunity to contain ransomware before mass encryption.
Decripte protects and responds to incidents in aviation and airports.
Pentest, 24x7 SOC, incident response with a 1-hour containment SLA and compliance — without building an internal team. Or start free by seeing what has already leaked from your company.