The M&S ‘Scattered Spider' hackers are coming for your holidays

Telegraph

a day ago

If air traffic control strikes, errant drones and climate protesters weren't enough to contend with, the aviation industry has a new antagonist threatening to grind things to a halt: hackers.
This week it emerged that the secretive 'Scattered Spider' group who attacked M&S and Co-op are targeting the aviation industry.
Charles Carmakal, an executive at Google's cybersecurity unit, said that his firm was 'aware of multiple incidents in the airline and transportation sector which resemble the operations [of] Scattered Spider.'
Sam Rubin, of Palo Alto Networks, said his company had 'observed Muddled Libra (also known as Scattered Spider) targeting the aviation industry.'
While neither Rubin nor Carmakal specified which airlines have been targeted, Hawaiian Airlines and WestJet have recently suffered cyber attacks. WestJet said the incident affected 'some services and software systems' including its app, but neither airline suffered operational disruption due to the breach.
The issue is not isolated to North America. On Monday June 30, Qantas suffered a major cyber attack, reportedly compromising the personal data of up to six million customers.
A spokesperson for the UK Civil Aviation Authority (CAA) told The Telegraph: 'We are aware of rumoured activity. We are in contact with the National Cyber Security Centre and have warned our industry contacts about this group and the techniques they use.'
One of the things that the CAA would have told their industry contacts is that when Scattered Spider targets an industry, the attack tends to be sustained and relentless for a period. If aviation is next in line, how could a hack play out, and what can you do to protect your holiday?
Worrying potential
There are a few different avenues for the hackers. One would be to target airlines' corporate infrastructure. In 2018, 380,000 British Airways customers had their credit card details stolen in a major data breach. Bookings made in a two-week window had been infiltrated in a 'very sophisticated, malicious criminal' attack, according to the airline's former CEO Alex Cruz. The airline was later fined £20m for the security breach.
A second scenario is that ground systems could be targeted. In 2015, Poland's flag carrier LOT cancelled 10 flights after hackers infiltrated the computer systems that issued flight plans from Warsaw's Chopin Airport. But the scale could be much bigger than this. In 2023, the US Federal Aviation Administration's 'Notice to Airmen' (NOTAM) system suffered a three-hour outage.
The result was that all flights across the US were grounded for the first time since 9/11, leaving 11,000 aircraft stuck on tarmac across the country. While this was a hardware issue, not a malicious hack, it highlights the potential impact of a sudden IT meltdown.
The third, and perhaps most worrying scenario, is that in-flight systems could be infiltrated. Earlier this year, several aircraft coming into land at Ronald Reagan National Airport in Washington DC received false mid-air collision warnings, even though there were no other planes in the area.
The pilots receiving the alerts disconnected autopilot and climbed rapidly. It is unknown whether this was caused by the deliberate, malicious 'spoofing' of airline systems, or if it was due to an error or another cause. Regardless, it is an example of how hackers could potentially enter the cockpit in the future, putting pilots into compromised scenarios.
This week's Qantas data breach suggests hackers are already targeting the databases of airlines. But given the nature of Scattered Spider's previous high-profile, high-impact attacks, scenarios two or three should not be ruled out.
'Hacking groups thrive on attention, and with families about to start jetting off on their summer holidays, the potential to attack and extort an airline is irresistible,' says Matt Saunders of Adaptavist, a tech consultancy which works with major airlines.
'The good news is that a potential hacking attempt should not cause safety issues for passengers, as any safety-critical IT systems will already have a manual backup option which maintains the highest safety standards in the event of an unwelcome intrusion,' he added.
How to hack-proof your holiday
There are steps that we, the passenger, can take to protect ourselves from cyber attacks. Paying for your holiday with a credit card is preferable; if somebody makes unauthorised payments on your card you will be protected by the Consumer Credit Act, meaning the process of reclaiming your lost funds will be more straightforward.
Regularly changing the password for your online account with an airline's website or app will also help to protect it from the rising issue of air-mile theft. And, as always, avoid booking tickets on public Wi-Fi networks which might not be encrypted, potentially putting your data at risk.
When it comes to the larger scale hacking incidents, we can only rely on the strength of airline security systems – which are, by all accounts, becoming more powerful. In 2024 alone, the aviation industry spent $37bn (£27bn) on IT systems, and airports spent $9bn (£6.5bn). Around half of airlines and three quarters of airports are in the process of safeguarding data and upgrading IT systems.
'Defending against these risks requires more than perimeter controls – it demands continuous workforce education, Zero Trust principles, phish-resistant multi-factor authentication and identity verification that can't be socially engineered,' stresses Jordan Avnaim of identity security company, Entrust.
Recent cyber attacks on Hawaiian, WestJet and Qantas did not affect flight operations, which should give us hope. Nevertheless, the fact that the shelves in some M&S stores were empty for six weeks and its online orders were suspended – to the sum of £300m – shows why airports, airlines and passengers should remain on high alert.