Alaska Airlines Restores Service After Temporary IT Outage Grounds Fleet

Alaska Airlines briefly grounded its entire fleet on Sunday night following an unspecified IT outage. While the ground stop was lifted in just three hours, the carrier warned travelers to expect some disruption on Monday as it repositions aircraft and crews.

Alaska requested a “temporary, system-wide ground stop” from the FAA at 8:00 PM Pacific Daylight Time (PDT) (11:00 PM Eastern Daylight Time) on Sunday for all Alaska Airlines flights and those of its subsidiary, Horizon Air.

The carrier, the fifth largest in the United States, blamed “an IT outage that’s impacting our operations.”

Photo: Alaska Airlines, Boeing 737-800. Courtesy of Cody Fitzgerald / Unsplash

Alaska subsequently cancelled 67 flights on Sunday and delayed a further 311, around a third of its 1,300 daily flights. However, it’s unknown how many disruptions were related to the ground stop, which took effect late in the day.

Alaska has an active fleet of 238 Boeing 737 aircraft and 87 Embraer 175 planes. Horizon Air, its regional subsidiary, has a fleet of 47 Embraer 175s.

Rising threat of cyber attacks on airlines

Alaska Airlines didn’t specify the nature of the IT outage. However, Hawaiian Airlines, owned by Alaska Air Group, was struck by a “cybersecurity event” in June, speculated to be a ransomware attack. Hawaiian Airlines flights continued to operate “safely and as scheduled” during the attack, the airline said.

Canadian carrier WestJet and Australian airline Qantas also disclosed cybersecurity incidents in June and July.

Photo: Courtesy of Arif Riyanto / Unsplash

On June 27, the FBI warned that the hacking group Scattered Spider is “expanding its targeting to include the airline sector” and that “anyone in the airline ecosystem, including trusted vendors and contractors, could be at risk.” Scattered Spider gained notoriety for its ransomware attacks on casinos, including Caesars and MGM, in 2023, as well as on British retailer Marks & Spencer this year.

Days later, Charles Carmakal, Chief Technology Officer at cybersecurity firm Mandiant, a subsidiary of Google, said in a LinkedIn post that his company is “aware of multiple incidents in the airline and transportation sector which resemble the operations of UNC3944 or Scattered Spider.” His post raises the possibility that other airlines have also been targeted but have not disclosed the attacks.

Meanwhile, on Sunday, Microsoft issued an alert about “active attacks” on its server software, which is used by government agencies and businesses.

However, the outage could have been an internal failure. Just over a year ago, Alaska had to request a similar ground stop after an update to a system that calculates weight and balance on aircraft went awry. That ground stop, requested in April 2024, was lifted within an hour but caused “residual delays” throughout the day, the airline said.

Ongoing disruption

Sunday’s grounding was similarly brief. Alaska Airlines requested the FAA lift the ground stop at 11:00 PM PDT (2:00 AM EDT), just three hours after requesting it.

However, Alaska said that travel could be disrupted throughout Monday.

Photo: Courtesy of Alaska Airlines

“As we reposition our aircraft and crews, there will most likely be residual impacts to our flights. It will take some time to get our overall operations back to normal,” the airline said in a statement.

“We apologize for the inconvenience and encourage guests to check the status of your flight before leaving for the airport.”

According to FlightAware, Alaska Airlines led all global airlines in the number of cancellations on Monday, with 57 flights canceled, or 6 percent of the total. Seventy-five Alaska Airlines flights had also been delayed, and its home base, Seattle-Tacoma International (SEA), was the worst destination airport in the world for canceled and delayed flights, as well as the third-worst originating airport.