Cyber Incident Victim: Airports Authority of India
Date:
Jul 2014
Location:
India
Summary
A cyberattack compromised the Airports Authority of India's secure website, resulting in the theft of critical aviation infrastructure data including details on 125 airports, flight paths, and air traffic management security credentials. The breach also disrupted the organization's Enterprise Resource Planning system and exposed employee financial information from salary databases. The incident prompted high-level government discussions due to potential risks to civilian safety and critical assets, leading to a temporary migration of infrastructure to the NIC portal while systems underwent investigation and remediation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 19, 2014, unknown hackers breached the secure website of the Airports Authority of India (AAI), a government enterprise managing 125 airports nationwide, including international hubs and civil enclaves at military airfields. The attackers compromised critical data related to airport infrastructure, flight paths of airlines operating in India, and security credentials for the Air Traffic Management (ATM) system, which controls airspace over India and adjoining oceanic regions. The breach rendered the Enterprise Resource Planning (ERP) system inoperative by the morning of July 20, when AAI personnel discovered the disruption. Stolen personnel records included salary databases containing employee bank information, creating potential financial exploitation risks. The compromised ATM credentials raised concerns about unauthorized flight diversions or terrorist attacks on civilian aviation assets if acquired by hostile groups.
AAI convened a secretary-level government meeting to assess the breach's implications given the sensitivity of aviation infrastructure data. Authorities initiated an investigation to determine the full scope of exfiltrated information, which remained undetermined at the time of reporting. As an immediate containment measure, administrators migrated AAI’s entire infrastructure backbone to the National Informatics Centre (NIC) portal pending server sanitization and restoration. The incident highlighted vulnerabilities in systems managing national aviation operations, particularly the ATM’s role in coordinating air traffic across international, customs, and domestic airports. No operational disruptions to flight services were reported, but the breach underscored risks to critical infrastructure data governing India’s civil aviation network.