Cyber Incident Victim: Radixx
Date:
Apr 2021
Location:
United States of America
Summary
A malware attack on technology provider Radixx triggered prolonged system outages affecting approximately 20 budget airlines globally, causing reservation systems to crash. The incident disrupted operations during critical periods, including one carrier's launch preparations forcing manual ticket sales and temporary booking solutions while restoration efforts progressed. Radixx confirmed no customer data compromise and involved law enforcement. The outage highlighted systemic vulnerabilities in airline reservation infrastructure, which experts note often stems from integrating legacy and modern technologies prone to operational failures.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 19, 2021, Radixx, a technology provider for low-cost airlines and subsidiary of Sabre Corp., detected unusual activity within its reservations system. The company subsequently confirmed a malware attack had disrupted its operations, triggering a multi-day outage affecting approximately 20 budget carriers globally. Radixx did not disclose technical details regarding the malware variant or its initial intrusion vector. By April 23, Radixx initiated service restoration efforts while maintaining that customer information remained uncompromised throughout the incident. The parent company, Southlake, Texas-based Sabre Corp., reported the attack to the FBI, though no law enforcement findings were publicly disclosed. Radixx emphasized its systems operated independently from Sabre’s primary platforms serving larger airlines, limiting the attack’s scope to its dedicated reservations environment.
The outage severely disrupted airline operations during peak travel preparation periods. Startup carrier Avelo Airlines, preparing for its inaugural California flights, lost reservation capabilities and directed customers to browse unavailable flights via its website. FlySafair, a South African budget airline, deployed an emergency one-way ticket platform for flights through April 27 while publicly acknowledging uncertainty about full system recovery. Vietnam’s Vietravel Airlines maintained limited counter sales at airports by attributing disruptions to “system maintenance.” Industry context revealed frequent airline technology outages, with U.S. congressional data citing approximately monthly incidents between 2015-2017, often attributed to integration challenges between legacy and modern systems. No additional technical containment measures, attacker attribution, or long-term remediation steps were documented in available reports during the immediate outage period.