Skip to content

Hartsfield-Jackson Atlanta International Airport denial-of-service attack

Summary

Hartsfield-Jackson Atlanta International Airport logo

A denial-of-service attack briefly interrupted access to Hartsfield-Jackson Atlanta International Airport’s website March 28, 2025. The airport’s IT team implemented protective measures, and the website was functioning normally later that day. Officials said airport operations were unaffected. The responsible actor and precise disruption duration remain unknown.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
  • Incident end:
    ? Confirmed or defensibly assessed end of material operational disruption or incident activity.

Critical infrastructure sector

Incident characteristics

Assessments

Data impacts

  • Unknown data impact

    The incident is cyber-related, but available evidence does not establish whether or how data was affected.

Operational impacts

  • Website unavailable

    A public-facing website was unavailable, disabled, or inaccessible.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

Extortion indicators

  • No known extortion indicator

    Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.

Incident narrative

Analyst assessment

A denial-of-service attack briefly disrupted the public website of Hartsfield-Jackson Atlanta International Airport on March 28, 2025. Airport officials told Atlanta News First that the IT team detected the attack that morning and activated standard protections, causing a short delay before the website appeared. The organization’s direct acknowledgment supports confirmed cyber involvement.

Operational significance

The documented effect was interrupted or delayed access to the airport’s website. Officials explicitly said airport operations were unaffected. FOX 5 Atlanta reported that the website was functioning normally later March 28, supporting a resolved status and the same calendar date for the beginning and end of the observed disruption. The precise start time, restoration time and duration were not disclosed.

The available account does not establish flight delays, terminal closures or disruption of airline, baggage or air traffic control systems. The airport’s physical setting identifies the affected organization; it does not establish an outage throughout the surrounding cities or counties.

Confidence and uncertainty

Confidence is high in the cyber cause and limited website disruption because contemporary reporting directly attributes both to airport officials. The sources identify denial of service but do not establish whether traffic came from multiple attack systems. No responsible actor, ransomware, extortion demand or unauthorized access to passenger information is established in the reviewed evidence.

Analytic gaps

The public record does not identify the targeted technical infrastructure, attack traffic characteristics or protective measures used. A more detailed technical account would be needed to establish the attack’s distribution and any effects beyond the reported website delay.

Organizations involved

Impacted locations

  • Atlanta, Georgia

    Georgia DOT’s original 2019 affected-environment study, printed page 3-28 (PDF page 35), places part of the airport within Atlanta’s city limits. This is airport site context; no City Hall impact or citywide outage is established.

  • Clayton County, Georgia

    County-level site anchor for airport portions in unincorporated Clayton County, documented in Georgia DOT’s original affected-environment study. The exact office-address Census match also places the College Park administrative office in Clayton County. This is physical airport context, without a countywide outage.

  • College Park, Georgia

    The Department of Aviation lists 6000 North Terminal Parkway, Atrium Suite 4000, Atlanta, GA 30320, as its physical address. An exact Census address match places the office in College Park city (1317776), Clayton County (13063), despite the Atlanta postal address. The municipality extends across Fulton and Clayton counties and retains its canonical Fulton parent. This site link documents the airport organization, without claiming terminal operations were disrupted.

  • Fulton County, Georgia

    County-level site anchor for airport portions in unincorporated Fulton County, documented in Georgia DOT’s original affected-environment study. This is physical airport context, without a countywide impact area or affected county government.

  • Hapeville, Georgia

    Georgia DOT’s original 2019 affected-environment study, printed page 3-28 (PDF page 35), places part of the airport within Hapeville, Fulton County. This documents the airport’s physical setting; Hapeville government is not a separate victim and no municipal outage is established.

Sources

Cyberattack Briefly Disrupts Atlanta Airport Website

We reported a brief denial-of-service disruption of the airport website, with no reported effect on airport operations.

Atlanta airport stops potential cyberattack Friday morning

Airport officials confirmed a brief website disruption following a denial-of-service attack and said operations were unaffected; the website was functioning normally later that day.

See something that needs correction?

Signed-in members can report an error, update, or missing source.