Cyber Incident Victim: Colorado Springs Airport
Date:
Oct 2022
Location:
United States of America
Summary
The Colorado Springs Airport experienced a denial of service cyberattack attributed to the Russian-linked group Killnet, causing temporary website downtime but no operational disruptions. Multiple U.S. airports, including Denver International Airport, were similarly targeted in coordinated attacks aimed at overwhelming public-facing websites, with minimal functional impact reported. The incidents prompted collaboration with federal agencies for monitoring and response.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On October 10, 2022, the Colorado Springs Airport (COS) experienced a cyberattack targeting its website, FlyCOS.com, which was hosted on the City of Colorado Springs’ domain, ColoradoSprings.gov. The attack, identified as a denial-of-service (DoS) incident, occurred in the morning and briefly rendered both FlyCOS.com and ColoradoSprings.gov inaccessible. According to airport spokesperson Dana Schield, the website was restored by 9 a.m. the same day, with no disruption to airport operations. The attack coincided with similar incidents targeting multiple U.S. airports, though the specific motive behind the COS breach remained unclear. The Denver International Airport (DIA) also reported a cyberattack beginning around 11 a.m. that day, characterized by attempts to overwhelm its public-facing website. DIA’s Public Information Officer, Stephanie Figueroa, confirmed the attacks were ongoing but had not caused significant operational impact at the time of reporting.
The attacks were attributed to Killnet, a hacker group with alleged ties to Russia, though no further technical details about the attack vectors or infrastructure were disclosed by either airport. Both COS and DIA emphasized proactive monitoring and coordination with federal agencies, including the Transportation Security Administration (TSA) and the Cybersecurity and Infrastructure Security Agency (CISA). COS clarified that its website functionality was fully restored within hours, while DIA noted its systems remained resilient despite continued attack attempts. Neither airport reported data breaches, compromised internal systems, or impacts to flight schedules, passenger safety, or ground operations. The incidents highlighted the broader pattern of coordinated cyberattacks against U.S. transportation infrastructure but resulted in minimal tangible consequences due to swift containment and redundant hosting arrangements.