Aviation services company Swissport announced it was the victim of a ransomware attack on Friday, with some flights forced into delays and other operations disrupted.
Neither the ransomware operator nor the type of ransomware used against the company is currently known, but the company reacted quickly to contain the attack, despite the disruption it caused.
"A part of Swissport’s IT infrastructure was subject to a ransomware attack," the company announced via Twitter on Friday. "The attack has been largely contained, and we are working actively to fully resolve the issue as quickly as possible. Swissport regrets any impact the incident has had on our service delivery."
At the time, its support website returned an error and was inaccessible, but a day later the company assured that the situation was under control and that affected systems were taken offline waiting to be restored from backups.
"IT security incident at Swissport contained. Affected infrastructure swiftly taken offline," it said on Saturday. "Manual workarounds or fallback systems secured operation at all times. Full system clean-up and restoration now underway. We apologise for any inconvenience."
"Due to system problems at our airport partner Swissport, 22 flights were delayed by 3 to 20 minutes yesterday," said a spokeswoman for Zurich Airport to Der Spiegel. Swissport told the publication that it was able to continue to provide ground services without full IT system access, though delays were inevitable.
Swissport provides ground services to airports such as passenger services, ramp and air cargo handling, fuelling, and executive hospitality services. In 2021, the company said it provided services to 97 million airline passengers and handled around 5 million tonnes of air freight at more than 100 cargo warehouses worldwide.
The hack follows a number of widely reported cyber attacks on critical infrastructure across Europe last week, including attacks on oil facilities in Germany, Belgium, and the Netherlands, the BBC reported.
Experts speaking at the time said it was not currently clear if the attacks were linked or coordinated, but some experts have speculated the attacks may be linked to current political tensions between Russia and Ukraine, the latter of which has received widespread and prominent support from European and other western powers as a potential war looms.
RELATED RESOURCE
Vulnerability and patch management
Keep known vulnerabilities out of your IT infrastructure
"This is the third attack in a week on European critical infrastructure providers," said Andy Norton, European cyber risk officer at Armis to IT Pro. "The attacks have focussed on the ancillary IT services that surround the production system or service.
"The NIS legislation in Europe requires critical infrastructure providers to attain a certain level of operational resilience," he added. "Whether the surge in attacks is related to current geo-political events is unknown. However, providers of critical services should immediately review the adequacy of their risk assessments from cyber threat with emphasis on the criticality of the ancillary IT systems that have increased connectivity and the potential to impact the OT and ICS production and service delivery."
-
Why keeping track of AI assistants can be a tricky businessColumn Making the most of AI assistants means understanding what they can do – and what the workforce wants from them
-
Nvidia braces for a $5.5 billion hit as tariffs reach the semiconductor industryNews The chipmaker says its H20 chips need a special license as its share price plummets
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the lastNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field dayNews February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
-
The Zservers takedown is another big win for law enforcementNews LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
