Swissport ransomware attack

On 3 February 2022, Swissport International — the world's largest provider of airport ground-handling and air-cargo services, operating at hundreds of airports across some 45 countries — was hit by ransomware. The BlackCat (ALPHV) gang later claimed responsibility and leaked 1.6 TB of stolen data, in an attack that briefly rippled into flight operations at Zurich Airport.

What happened

The ransomware struck Swissport's IT infrastructure on 3 February. The company reported the incident publicly on 4 February, stating that parts of its IT systems were affected and that compromised devices had been taken offline. Ground-handling disruptions caused 22 flight delays at Zurich Airport, though the operational impact stayed limited because staff fell back on manual workarounds and redundant systems.

Swissport said it contained the incident within about 48 hours. On 14 February 2022, the BlackCat (ALPHV) ransomware operation — a Russian-speaking group that had evolved out of the DarkSide/BlackMatter lineage behind the 2021 Colonial Pipeline attack — claimed the breach and published a sample of stolen files on its leak site.

Impact

• 22 flights were delayed at Zurich Airport on the day of the attack; broader ground-handling operations were degraded for roughly 48 hours.
• BlackCat claimed to have stolen and offered for leak 1.6 TB of data.
• The leaked sample included personal and HR information, such as job-applicant records, passport scans, and other identity documents — a classic double-extortion play combining encryption with data theft.

Response

Swissport activated business-continuity procedures, isolated affected systems, and restored operations within days. The company worked with external incident responders and cooperated with authorities. It publicly stated that flight operations were not materially affected beyond the initial delays and that it had no indication of broader operational compromise.

Why it matters

The Swissport attack underscored the systemic fragility of aviation supply chains: because ground handlers sit at the operational heart of dozens of airlines and airports, even a quickly contained intrusion can cascade into flight delays across a hub. Coming weeks after ransomware disruptions at European oil terminals, it became a reference case for how the BlackCat/ALPHV affiliate model targeted critical-infrastructure operators, and it reinforced calls for stronger third-party and operational-technology resilience across the air-transport sector.