DOT Rule Exempts Airlines from Compensation for Cyberattack-Related Delays
Starting next month, the U.S. Department of Transportation (DOT) will allow airlines to avoid providing meal vouchers, hotel accommodations, or other compensation to passengers if flights are canceled or delayed due to a cyberattack provided the airline complies with existing cybersecurity regulations.
The change is part of a broader DOT rule published last week that establishes a new "cause of delay" category for tracking disruptions while reducing airline obligations in 10 specific scenarios, including cybersecurity incidents. Under the rule, these events are classified as "not controllable," meaning airlines are no longer required to offer amenities or compensation when such disruptions occur.
The rule stems from the 2024 FAA Reauthorization Act, which directed the DOT to create this classification. A DOT spokesperson stated that the new reporting category will ensure government delay data accurately reflects what airlines can and cannot control.
Consumer advocacy groups have expressed mixed reactions. FlyersRights criticized the rule for being implemented without public comment, arguing that cybersecurity is an airline responsibility and that carriers should demonstrate their systems are resilient. The National Consumers League acknowledged that the rule provides clarity for passengers but raised concerns about potential abuse of other exemptions, such as "unscheduled maintenance."
Legal experts note that the rule’s language on cybersecurity compliance is intentionally broad, allowing flexibility based on the nature of an attack. Airlines that fail to meet regulatory standards will still be subject to compensation requirements.
While cyberattacks have previously disrupted flights such as last year’s Collins Aerospace breach in Europe there is no formal record of how often they have triggered compensation. The 2023 CrowdStrike IT outage, though not a cyberattack, led to some airline compensation, as the DOT determined it was within carriers’ control.
The Biden administration has previously imposed cybersecurity regulations on aviation sector entities due to persistent threats. The Aviation Information Sharing Analysis Center (Aviation ISAC) praised the new rule for simplifying cybersecurity reporting across agencies.
Source: https://cyberscoop.com/dot-rule-airline-cyberattack-flight-delays/
RTX cybersecurity rating report: https://www.rankiteo.com/company/rtx
"id": "RTX1789165418",
"linkid": "rtx",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "60",
"impact": "2",
"explanation": "Attack limited on finance or reputation"{'affected_entities': [{'customers_affected': 'Passengers experiencing flight '
'disruptions',
'industry': 'Aviation',
'location': 'United States',
'name': 'U.S. Airlines',
'type': 'Industry Sector'}],
'customer_advisories': 'Passengers may not receive compensation for flight '
'disruptions caused by cyberattacks if airlines meet '
'regulatory cybersecurity standards.',
'description': 'Starting next month, the U.S. Department of Transportation '
'(DOT) will allow airlines to avoid providing meal vouchers, '
'hotel accommodations, or other compensation to passengers if '
'flights are canceled or delayed due to a cyberattack, '
'provided the airline complies with existing cybersecurity '
'regulations. The rule classifies cybersecurity incidents as '
"'not controllable,' reducing airline obligations in such "
'scenarios.',
'impact': {'brand_reputation_impact': 'Potential negative perception due to '
'reduced passenger rights',
'downtime': 'Flight cancellations or delays',
'legal_liabilities': 'Airlines may face legal action if found '
'non-compliant with cybersecurity regulations',
'operational_impact': 'Reduced passenger compensation obligations '
'for airlines'},
'lessons_learned': "Cybersecurity incidents are now classified as 'not "
"controllable' under DOT rules, reducing airline "
'compensation obligations. Airlines must demonstrate '
'compliance with cybersecurity regulations to qualify for '
'exemptions.',
'post_incident_analysis': {'corrective_actions': 'Airlines must ensure '
'compliance with '
'cybersecurity regulations '
'to qualify for exemptions.',
'root_causes': 'Regulatory change driven by the '
'2024 FAA Reauthorization Act to '
'classify cybersecurity incidents '
"as 'not controllable.'"},
'recommendations': 'Airlines should ensure robust cybersecurity measures to '
'avoid legal liabilities and maintain passenger trust. '
'Consumer advocacy groups recommend public transparency '
'and accountability in cybersecurity practices.',
'references': [{'source': 'U.S. Department of Transportation (DOT)'},
{'source': '2024 FAA Reauthorization Act'},
{'source': 'FlyersRights'},
{'source': 'National Consumers League'},
{'source': 'Aviation Information Sharing Analysis Center '
'(Aviation ISAC)'}],
'regulatory_compliance': {'legal_actions': 'Potential legal actions if '
'airlines fail to meet '
'cybersecurity standards',
'regulatory_notifications': 'DOT rule published to '
"establish new 'cause "
"of delay' category for "
'cybersecurity '
'incidents'},
'stakeholder_advisories': 'Airlines must comply with existing cybersecurity '
'regulations to qualify for compensation exemptions '
'under the new DOT rule.',
'title': 'DOT Rule Exempts Airlines from Compensation for Cyberattack-Related '
'Delays',
'type': 'Regulatory Change'}