Hawaiian Airlines cybersecurity incident

Analyst assessment

Hawaiian Airlines identified a cybersecurity incident on June 23, 2025. Its parent company disclosed that date in a June 27 SEC filing, following the airline’s June 26 public notice. Our reporting documented the initial IT disruption while flights continued.

Operational significance

The company’s second-quarter filing explains that affected Hawaiian systems and applications were disconnected to protect the network. This establishes an interruption of access to internal technology, even though the carrier maintained its flight schedule. The disclosures do not identify each application or quantify staff and customer inconvenience.

That filing says access to all systems was restored after quarter-end. The 2025 annual report reiterates restoration and uninterrupted flights. Operational disruption is therefore resolved, but no exact return-to-service date is established. Neither the quarter’s June 30 closing date nor a filing’s publication date is used as the restoration date.

Confidence and uncertainty

Confidence is high because the airline and its parent directly acknowledged cyber involvement, containment and recovery. Continued flights limit the documented operational consequences; they do not imply that the disconnected IT systems were functioning normally throughout the response.

The Record reported a possible Scattered Spider connection through anonymous incident responders and sector-wide warnings. Those reports do not establish definitive responsibility for this victim. No named actor is assigned as confirmed, and no ransomware or encryption finding is established. Orderly restoration does not independently establish ransomware or any particular attack mechanism.

The annual report says the investigation found no material impact on Hawaiian’s business, results or financial condition. That financial assessment does not independently prove that no information was accessed. The reviewed incident-specific disclosures do not establish a confirmed theft scope, notification population or ransom demand.

Analytic gaps

The intrusion window, precise affected applications, initial-access method, data findings, recovery date and definitive attribution remain unresolved in the public evidence reviewed. The airline’s June 26 social notice corroborates the initial IT impact and continued safe flights, without adding a technical diagnosis.

Honolulu is the affected carrier’s headquarters location. The incident does not establish disruption at every airport or destination on Hawaiian’s network, and no route-wide or statewide service interruption is inferred.