Akira ransomware attack disrupts flights at Croatia's Split Airport

Split Airport, also known as St Jerome Airport and one of Croatia's busiest, lost the use of its IT infrastructure to a cyberattack on the evening of Monday, July 22, 2024. Systems went down at around 7:30 pm local time, and staff fell back on manual check-in and boarding using passenger lists supplied by the airlines.

Flights scheduled after the shutdown were cancelled or diverted, and some passengers spent the night at the airport. Ex-Yu Aviation reported that about 70 percent of scheduled flights operated the following day, with significant delays and further cancellations, and that disruption continued into the Wednesday. Total Croatia News, citing the airport, described only minor delays by the morning after the attack. Eight IT specialists worked overnight on recovery.

The Akira ransomware group claimed responsibility and pressed for negotiations. Luksa Novak, president of the airport's management board, said it had not been established whether Akira was in fact behind the attack or whether another party had used its name. He said the position of both Split Airport and the Croatian government was that negotiations were out of the question.

The airport said its priority after the incident was restoring service for passengers and airlines rather than assessing damage. Near normal operations resumed within roughly 48 hours, although some systems were still being rebuilt and delays persisted for several days afterwards.