INDUSTRY FACT FILE · AVIATION & AEROSPACE

Five New Case Studies in Aviation and Aerospace Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in airports, airlines, loyalty programmes and aerospace suppliers and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Check-in That Went Manual 3.  Case Study 2: The Passengers Who Were Already Gone 4.  Case Study 3: The Baggage System on the Office Network 5.  Case Study 4: The Miles That Flew Away 6.  Case Study 5: The Supplier That Stopped the Line

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in aviation and aerospace with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, ICAO Annex 17 as implemented by DGCA and BCAS, SEBI disclosure for listed companies, DPDP and the partner, OEM and EASA Part-IS requirements that reach Indian organisations.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Check-in That Went Manual	Metro airport operator	Outage of a shared common-use check-in platform	CERT-In; BCAS; airline and tenant contracts	B9, B10, B3
2. The Passengers Who Were Already Gone	Full-service airline	Passenger data breach at a passenger-processing provider	CERT-In; DPDP; SEBI LODR	B9, B6, B8
3. The Baggage System on the Office Network	Hub airport operator	Ransomware spreading from IT to baggage, BMS and access control	CERT-In; Annex 17; NCIIPC	B1, B3, B7
4. The Miles That Flew Away	Airline loyalty programme	Credential stuffing and loyalty redemption fraud	CERT-In; DPDP; SEBI LODR	B2, B7, B1
5. The Supplier That Stopped the Line	Aerospace precision-parts supplier	Ransomware halting deliveries and threatening export-controlled data	CERT-In; OEM contracts; export controls	B3, B5, B7

The airport's own network was never touched. Every counter still stopped.

At a glance
Organisation	A PPP metro airport (“Aeroco A”) running common-use check-in, bag drop and boarding for all airlines on one provider's platform
Threat	A cyber incident at the platform provider taking check-in, bag drop and boarding systems offline at the airport
Why it is new	Shared platforms concentrate risk, and the fallback is a rehearsal, not a product
Codec Networks services	Provider assurance, fallback exercises, segmentation and continuity (Bundles B9, B10, B3)

The scenario

Aeroco A had migrated every airline counter, kiosk and bag-drop unit to a single common-use platform. The provider was assessed at contract signature three years earlier and never again; the contract set uptime targets but no recovery objectives or notification timelines for cyber incidents.

On a Friday evening the provider detected an intrusion and took the platform offline globally. At Aeroco A, kiosks went blank, bag drops stopped printing tags and boarding gates lost their systems; airlines received no clear estimate of restoration.

Manual procedures existed on paper but had never been rehearsed with airlines and handlers. Handwritten tags, spreadsheet manifests and manual boarding took three times as long, queues spilled outside the terminal and dozens of flights were cancelled or diverted over two days.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Critical provider assessed once and never recertified.
• No contracted recovery objectives or notification duties for cyber incidents.
• Manual fallback unrehearsed with airlines and handlers.
• No alternate check-in path independent of the shared platform.

The impact

Aeroco A faced airline claims, regulator questions, days of negative coverage and a tenant review of its platform strategy. It reported the incident to CERT-In as an affected entity and rebuilt its provider contracts and contingency plans.

The regulatory lens

• CERT-In Directions: the airport reported the operational impact within six hours; provider logs were needed for investigation.
• BCAS and DGCA: the national security and safety programmes expect continuity of passenger processing and screening.
• Airline and tenant contracts: service-level and liability clauses invoked by airlines.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assure the platform	Provider risk assessment and recertification, contracted recovery and notification duties	B9
Rehearse the fallback	Joint platform-outage exercises with airlines, handlers and the provider; manual playbooks	B10
Build alternatives	Dependency mapping, alternate check-in paths and segmentation of local systems	B3

Key lessons Recertify the providers you cannot operate without. Put recovery and notification duties in contracts. Rehearse manual processing with airlines and handlers. Keep an alternate path independent of the shared platform.

The airline's systems were secure. A decade of its passengers' passports was somewhere else.

At a glance
Organisation	A listed airline (“Flyco B”) outsourcing passenger service and loyalty data processing to a global provider
Threat	A breach at the provider exposing names, dates of birth, passport and ticket details and loyalty data of millions of passengers
Why it is new	The largest aviation breaches happen at providers, and passports cannot be reset
Codec Networks services	Processor assurance, DPDP programme, breach response (Bundles B9, B6, B8)

The scenario

Flyco B's provider held passenger records going back ten years because neither party had agreed retention limits. The provider was breached and the attackers took the full data set, including passport numbers and dates of birth.

The provider notified Flyco B of an incident within days but took weeks to confirm which passengers were affected; Flyco B could not report precise impact to CERT-In or inform passengers meaningfully until it knew.

Phishing campaigns quoting real itineraries followed. Flyco B notified millions of passengers, offered monitoring, disclosed the incident under SEBI LODR and faced questions on why a decade of passport data had been retained.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• No retention limits agreed with the processor.
• Processor security assessed only at onboarding, with no audit rights exercised.
• No notification timelines or data-subject identification duties in the contract.
• No passenger data map showing which processors held passports.

The impact

Flyco B bore notification and monitoring costs, reputational damage and a quarterly disclosure, and rebuilt its processor contracts and data retention regime.

The regulatory lens

• CERT-In Directions: the breach was reported within six hours of Flyco B becoming aware; impact was updated as the provider confirmed scope.
• DPDP: once in force, breach intimation to the Board and affected passengers and retention limits would apply to Flyco B as data fiduciary.
• SEBI LODR: disclosed in the quarterly corporate governance report.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assure the processor	Processor assessments, audit rights, notification and identification duties in contracts	B9
Govern the data	DPDP programme: passenger data map across processors, minimisation, retention, breach workflow	B6
Respond and notify	Forensic coordination with the provider, CERT-In, passenger and disclosure support	B8

Key lessons Map every processor that holds passenger data. Set and enforce retention limits. Contract for fast, specific breach notification. Prepare passenger notification before you need it.

The attackers phished the finance team. The belts stopped anyway.

At a glance
Organisation	A hub airport (“Hubco C”) whose baggage handling, building management and access control servers shared the corporate network
Threat	Domain compromise from a phished finance account followed by ransomware across IT and OT servers
Why it is new	Airports are OT environments with IT front doors
Codec Networks services	Airport IT/OT assessment, segmentation, SOC (Bundles B1, B3, B7)

The scenario

Hubco C's baggage handling system servers, building management and access control sat on the corporate domain for convenience; vendors maintained them through standing VPNs. Nobody held a current inventory of the controllers behind them.

A finance employee was phished. Within two weeks the attackers held domain administrator rights and, on a holiday weekend, deployed ransomware that encrypted file servers, the baggage system servers, BMS and the access control database.

Bags were hand-sorted, security doors were manually controlled by staff, air handling ran on defaults and departures slipped for days. Recovery took a week because PLC programs and system configurations had never been backed up and vendors had to rebuild from scratch.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• OT servers on the corporate domain with no segmentation.
• Standing vendor VPNs and no OT asset inventory.
• EDR alerts unmonitored over the weekend.
• No backups of PLC programs or system configurations and no restart sequence.

The impact

Hubco C suffered days of disruption, airline claims, security-programme scrutiny from BCAS, a CERT-In report and an expensive rebuild, and commissioned a full IT/OT re-architecture.

The regulatory lens

• CERT-In Directions: incident reported within six hours; audit guidelines expect OT in audit scope.
• ICAO Annex 17 (4.9.1): baggage and access control are exactly the critical ICT systems the Standard asks States to protect.
• NCIIPC: a major airport's systems may be notified protected systems with additional duties.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assess the airport	Airport IT/OT assessment with asset discovery of baggage, BMS, access control and CCTV	B1
Segment and recover	Zone-and-conduit segmentation, brokered vendor access, PLC and configuration backups, restart drills	B3
Detect early	24x7 SOC with EDR monitoring across IT and OT zones	B7

Key lessons Keep airport OT off the corporate domain. Inventory and back up every controller and configuration. Broker and record vendor access. Monitor EDR around the clock, including holidays.

Nobody hacked the loyalty platform. They simply logged in with passwords from somewhere else.

At a glance
Organisation	The loyalty programme of a listed airline (“Milesco D”) with millions of members and partner-earned miles
Threat	Replay of leaked credentials against the loyalty app, followed by redemption of miles for tickets and vouchers
Why it is new	Miles are cash equivalents behind consumer-grade authentication
Codec Networks services	App and API security, SOC with fraud signals, ATO testing (Bundles B2, B7, B1)

The scenario

Milesco D's app allowed unlimited login attempts from the same device, did not check passwords against leaked lists and required no step-up authentication for redemptions or contact-detail changes.

Attackers replayed millions of credential pairs from unrelated breaches and took over tens of thousands of accounts whose owners reused passwords. Miles were redeemed for tickets issued to new names and vouchers emailed to addresses added minutes earlier.

Members discovered empty balances during the holiday season. The fraud team saw refund requests; the security team saw nothing, because login telemetry was not in the SOC. The pattern emerged only when the two compared data.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No rate limits or leaked-credential checks on login.
• No step-up authentication for redemptions or contact changes.
• Login and redemption telemetry not monitored by the SOC.
• Fraud and security teams worked separately.

The impact

Milesco D restored miles, absorbed ticket and voucher losses, reset millions of passwords, reported the incident to CERT-In and disclosed it under SEBI LODR. Member engagement fell for a quarter.

The regulatory lens

• CERT-In Directions: unauthorised access to accounts reported within six hours of recognition.
• DPDP: member data and contact details affected; breach intimation would apply once provisions commence.
• SEBI LODR: disclosed in the quarterly corporate governance report.

How Codec Networks would help

Need	Codec Networks response	Bundle
Fix the flows	Loyalty app and API security: rate limits, leaked-credential checks, step-up authentication, redemption logic	B2
See it in time	SOC monitoring of login, redemption and contact-change anomalies with fraud signals	B7
Prove it	Credential-stuffing and account takeover testing with retests	B1

Key lessons Rate-limit logins and check for leaked passwords. Require step-up authentication before miles leave the account. Monitor login and redemption telemetry in the SOC. Give fraud and security teams one view.

The OEM's line in another country stopped because a supplier's ERP and CAD shared one flat network.

At a glance
Organisation	A private aerospace supplier (“Aeroco E”) machining structural components for global airframe and engine OEMs
Threat	Ransomware encrypting ERP, CAD and quality records with stolen drawings threatened for publication
Why it is new	Indian suppliers are deeper in global programmes than their security evidence
Codec Networks services	Segmentation and backups, OEM assurance, SOC (Bundles B3, B5, B7)

The scenario

Aeroco E ran ERP, CAD, quality records and shop-floor systems on one flat network with shared administrator credentials. Backups were online. An OEM audit was scheduled for the following month.

A phishing email led to ransomware that encrypted ERP, CAD and the quality system and deleted the backups. The attackers claimed to hold OEM drawings—some export-controlled—and threatened publication.

Deliveries stopped, the OEM suspended Aeroco E pending an independent assessment, export-control counsel was engaged over the threatened drawings, and recovery took weeks from vendor copies and paper records.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Flat network across ERP, CAD, quality and shop floor.
• Shared administrator credentials and no MFA.
• Online backups deleted by the attackers.
• No classification or segregation of export-controlled design data.

The impact

Aeroco E lost weeks of deliveries, faced OEM suspension and insurance scrutiny, reported the incident to CERT-In, engaged export-control counsel and funded an independent assessment and ISMS build to regain approved-supplier status.

The regulatory lens

• CERT-In Directions: incident reported within six hours; logs needed for investigation.
• OEM contracts: supplier security requirements, notification duties and audit rights invoked.
• Export controls: threatened disclosure of controlled technical data required legal assessment and reporting.

How Codec Networks would help

Need	Codec Networks response	Bundle
Separate and recover	Segmentation of ERP, CAD, quality and shop floor; immutable backups and tested restores; design data classification	B3
Prove it to the OEM	ISO 27001-aligned ISMS, OEM questionnaire and export-control readiness, evidence pack	B5
Detect early	EDR with 24x7 SOC monitoring and incident response retainer	B7

Key lessons Classify and segregate controlled design data. Keep backups immutable and offline. Remove shared administrator credentials. Build the ISMS before the OEM audit, not after the incident.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com