Headlines

FBI Warns Airlines of Scattered Spider Cyber Threat

Published JUL 2 2025

Story

Above: A passenger plane descending for landing at San Francisco International Airport on June 24, 2025. Image credit: Tayfun Coskun/Anadolu/Getty Images

The Facts

The cybercriminal group Scattered Spider has expanded its operations to target the airline sector in the U.S. and Canada to gain access to private information for extortion, the FBI has warned.
CNN
The Hill
In an alert issued last Friday, the FBI stated that the criminal organization relies on “social engineering techniques, often impersonating employees or contractors to deceive IT help desks into granting access,” to bypass multi-factor authentication.
X
The agency added that it was “actively working” with the aviation industry to assist victims and urged those who suspect they may have been targeted to report it to the FBI. Additional warnings were also issued by Google’s Mandiant and Palo Alto Networks.
X
LinkedIn
ABC
Scattered Spider is believed to be a loose affiliation of predominantly English-speaking cybercriminals, some as young as 16, based primarily in the U.K. and the U.S., who have caused hundreds of millions of pounds in damage across multiple industries since 2022.
Independent
ABC
Previous high-profile attacks attributed to the group include breaches at U.K. retailers Marks & Spencer, Co-op, and Harrods, as well as U.S. casinos MGM Resorts and Caesars Entertainment, with M&S losing approximately £300 million in profits from its attack.
New York Post
The Standard
The alerts follow several North American airlines confirming security breaches in June, including Hawaiian Airlines and Canada’s WestJet. Delta Airlines, meanwhile, reportedly locked some customer accounts over security concerns, though it denied experiencing a breach.
WestJet official site
Hawaiian Airlines
The Hill

Sources Split

LEFT

CENTER

RIGHT

ESTAB
CRIT

CENTER

PRO
ESTAB

The Spin

Narrative A

In light of Scattered Spider’s increased activity targeting the aviation industry, potential victims must contact the authorities. Reporting early allows the FBI to intervene quickly, share intelligence, and prevent further compromises. In the meantime, the FBI will work closely with industry partners and victims to mitigate the threat and help those targeted.

Narrative B

Scattered Spider’s success is a result of poor verification practices rather than technical ability, with the group using low-tech methods like social engineering and phishing in recent attacks. To protect against this, the cybersecurity industry must offer back-door protections rather than focusing solely on high-tech solutions, which fail to counter the threat.