The IT system at Split Airport is currently under a hacker attack, causing significant delays and disruptions to air traffic, reported ZL sv. Jerome. The issues began on the evening of July 22nd, around 7:30 PM, when initial problems with the IT system prevented the acceptance and dispatch of aircraft. Despite these challenges, Mate Melvan, head of the reception and dispatch service, told HINA that flights to Zurich, Zagreb, Paris, Stuttgart, Munich, Oslo, Stockholm, Bergen, Tallinn, London Gatwick, and London City were still dispatched that evening after manually processing aircraft and passenger data.
The situation persisted throughout the night, and this morning, July 23rd airport’s assistant director, Pero Bilas, addressed the public, confirming that the IT system’s malfunction was due to a hacker attack: “Professional services are working intensively to eliminate consequences of this attack. We are in contact with all airlines and together we are looking for alternative solutions. We ask all passengers for patience,” HRT reports.
Throughout the morning, air traffic at Split Airport remained difficult and slowed, with passenger check-ins being conducted manually. The airport administration emphasized that while there may be delays in departures, the operational processes for arrivals are proceeding without difficulty.
Later in the day, the Minister of Transport of the Republic of Croatia, Oleg Butković, also addressed the situation and noted:“The system has not yet been restored to its pre-attack level, although operations are continuing. The dispatch and arrival of aircraft are proceeding normally, but the process is much more difficult and exhausting for the staff. Nevertheless, we are committed to this path. All relevant institutions, including those responsible for cyber security from the Ministry of Interior, are involved. The professionals are currently working to restart the system from scratch. I cannot provide an exact timeline for when the system will be fully operational, but we are aiming for the earliest possible resolution. Given that we are in the peak of the tourist season, with a 10% increase in passenger numbers compared to last year, this is a critical time. Summer is always the busiest season, with Split Airport handling twice the traffic of Zagreb and more than Dubrovnik. We are making every effort to restore the system as quickly as possible.”
Around 3 PM on July 23rd, Lukša Novak, director of St. Jeronim Airport, confirmed that the attack was carried out by the “Akira” group. He described the attack as very serious, with messages from the hackers demanding negotiations for potential payments to obtain certain keys. He reiterated the position of the Government of the Republic of Croatia, which is not to negotiate with criminals or hackers in any way. Novak also stated that eight to ten experts worked through the night and morning to resolve the issue. A decision was made to revert to the “classic” method of processing passenger and aircraft data. This involved coordinating with all carriers to deliver passenger lists, serving as the basis for data processing, “as it used to be done in the past,” he added.
On that occasion, the Minister of the Interior of the Republic of Croatia, Davor Božinović, pointed out that this is a case of ransomware, where hackers demand a ransom to unlock data. He mentioned that expert services have isolated the geolocation of the hacker group. “Since last night, all our services have been cooperating within Croatia, as well as with Europol, the FBI, and other partner services worldwide. It is important to clarify that this is a cyber attack, not a terrorist attack—this is classic ransomware. Our position is that there are no negotiations with criminal groups. As for the recovery of the system, we are actively working on it, and I am confident that it will be resolved in due time.”
As a result of the hacker attack on Monday, July 22nd, four flights were canceled and 77 flights were delayed. On Tuesday, July 23rd, by 4 PM, three flights were canceled and 42 were delayed. Additionally, the airport’s website is currently unavailable.
