Cyber Incident Victim: PlaneFinder
Date:
Sep 2020
Location:
United Kingdom
Summary
A major flight tracking service, PlaneFinder, along with another prominent platform, experienced severe service disruptions due to multiple coordinated cyberattacks targeting real-time flight data providers. The attacks rendered live feeds temporarily inaccessible to users, requiring operational repairs to restore functionality. Both services, widely used by aviation enthusiasts and travelers globally, track aircraft details including flight numbers, models, altitudes, and speeds. The incident highlighted vulnerabilities in critical aviation data infrastructure amid a concentrated hacking campaign against the sector.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The PlaneFinder flight tracking service experienced significant disruptions due to a series of cyberattacks occurring around September 27-29, 2020. These attacks formed part of a coordinated campaign targeting real-time flight tracking platforms, with both PlaneFinder and Flightradar24 sustaining multiple assaults over two days. PlaneFinder confirmed service interruptions via Twitter, requesting user patience during restoration efforts. On September 29 at approximately 12:40 PM GMT, the platform became completely inaccessible, preventing users from viewing live flight data feeds. Service was restored prior to the publication of Hackread.com's report later that day, though the exact duration of the outage remains unspecified. The attacks caused operational paralysis during downtime periods, directly impacting aviation enthusiasts and travelers who relied on the platform for real-time aircraft monitoring.
PlaneFinder, operational since 2009, provided specialized services including MLAT and ADS-B data sharing through client software and VFR chart support. Its historical flight replay feature, offering data back to 2011, represented a unique archival capability among tracking services. The platform's global user base, comprising millions of registered members, typically accessed detailed flight information including aircraft models, altitudes, speeds, destinations, and distress signals. The cyberattacks temporarily disabled these core functions, though no data breaches or permanent system damage were reported. Both affected platforms served as critical resources for monitoring thousands of daily flights worldwide, with the incident highlighting vulnerabilities in aviation-related data services. Restoration efforts focused on resuming live tracking capabilities without public disclosure of technical countermeasures or attribution.