SITA

Profile narrative

SITA is a threat actor known by the alias SITA and is associated with activity traced to the United States of America. The actor’s known focus includes the aviation sector, particularly targeting organizations that provide information technology and communications services to airlines worldwide. This focus is evident from the actor’s involvement in an incident that affected a major global airline IT provider.

In March 2021 the actor carried out a highly sophisticated cyberattack against SITA, the IT and communications provider that serves roughly ninety percent of global airlines. The breach occurred on U.S.-based servers located in Atlanta and specifically targeted the Passenger Service System infrastructure. Through this compromise the actor gained unauthorized access to frequent‑flyer information belonging to multiple airline carriers. The incident highlighted supply‑chain vulnerabilities within the aviation sector by demonstrating how a breach at a single service provider could propagate passenger data exposure across numerous airlines.

No further publicly reported operations or campaigns have been attributed to this actor in the available sources, and no definitive attribution to a state sponsor or criminal consortium has been made public. Consequently, details regarding the actor’s broader affiliations, tooling preferences, or additional tactics remain undocumented in the current context. The March 2021 event stands as the sole confirmed incident that defines the actor’s known activity profile.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 0 sources.