Anywayanyday cyberattack halts Russian travel bookings

Anywayanyday, a Russian online travel agency, has stopped taking new bookings after a cyberattack hit its IT infrastructure. Customers currently cannot buy airline or train tickets or reserve hotel rooms through the platform.

The company disclosed the incident on Wednesday. Its website was still offline at the time while staff worked to bring systems back.

Bookings frozen, existing reservations still valid

The disruption affects new purchases only. Reservations that were confirmed before the attack remain valid, according to the company. Anywayanyday has not said when it expects normal operations to resume.

"We have already taken steps to strengthen our security and are working to restore service availability," the company said in a statement.

Anywayanyday also said it had found no evidence that customers' personal data was compromised. That assessment may change as the investigation continues, but for now the company describes the incident as a service outage rather than a data breach.

Several key details are missing. The company has not named the attackers or explained how they got into its systems. It has also not said what kind of attack it faced. The statement mentions damage to its "IT infrastructure" and does not say whether ransomware, a denial-of-service attack or something else was involved.

One of Russia's oldest booking services

Anywayanyday launched in 2008, which makes it one of the longest-running online travel booking services in Russia. As of 2025, it worked with about 800 airlines and 330,000 hotels.

A platform of that size sits between travelers and a large network of carriers and accommodation providers. When it goes offline, the disruption spreads beyond the company itself. Customers who rely on it for travel have to find other channels, and partners lose a sales route until service returns.

A rough week for Russian aviation

The attack comes during a wider disruption to air travel in Russia. A wave of Ukrainian drone attacks aimed at Moscow has hit flight schedules hard.

Since Tuesday evening, more than 500 flights have been delayed or canceled at airports serving the Russian capital. Rosaviatsia, Russia's federal aviation authority, has imposed temporary restrictions on arrivals and departures at all four major Moscow airports.

The source does not link the cyberattack on Anywayanyday to the drone strikes. It only notes that the two events happened at the same time.

Booking systems have been hit before

Russian airline booking systems have been targeted in the past. In 2023, a large distributed denial-of-service (DDoS) attack disrupted Leonardo, an airline reservation system used by several Russian carriers. That incident caused flight delays at airports.

A DDoS attack floods a system with traffic until it can no longer respond to legitimate users. Unlike intrusions that steal or encrypt data, these attacks mainly aim to knock services offline. They are often used to cause visible disruption.

Our Take

The Anywayanyday incident shows how exposed travel platforms are. Their entire business depends on being available around the clock, so even a short outage leaves customers stranded and partners waiting. We have seen the same pattern elsewhere. Attacks on cloud providers, such as the IDCF Cloud ransomware incident, and on consumer brands like those caught up in the TFG London cyberattack, have caused similar damage downstream.

The timing matters too. The attack coincides with heavy drone-related disruption in Moscow, and Russian reservation systems have been targeted before. This suggests the country's travel sector remains an attractive target for anyone looking to cause visible disruption. Without attribution or technical details, though, the motive cannot be established.

It is worth watching whether Anywayanyday publishes more about the attack method, whether any group claims responsibility, and whether its early finding that customer data was not affected holds up once systems are fully restored.