Savelovsky court of Moscow rediscusss the case of former vice-presidents of “Siren-Travel” I. R. and A. K. The investigation believes that errors in the protection of the Leonardo booking system helped hackers to penetrate the internal network of the company and get information about air passengers. The defendants themselves insist that such a chain of events has not been proven.
The case is connected with cyber attacks that affected the infrastructure of “Siren-Travel” in the fall of 2023. Due to failures in Leonardo, airlines and airports had problems with passenger registration and baggage.
The criminal case was opened in November 2023, and in the spring of the following year. R. and A. K. Detained. At first, they were imputed to implicitly exposure to critical information infrastructure, but later the investigation changed the article. Now former managers are accused of violating the rules of operation and storing protected computer information, which entailed serious consequences.
I. R. was engaged in the technical development of Leonardo. A. K. was responsible for information security and personal data protection.
According to the prosecution, the attackers gained control over the computer I. R. in the period from August 25 to September 15, 2023. The device allegedly stored the login and password from the booking system, although internal rules forbade to leave such data on a working computer.
The investigation believes that the attackers infected the device with malware, used the found details and penetrated into the internal systems of the company. A. K. is accused of not organizing the necessary measures of the defense, although this was part of his duties.
After the entry, the hackers, according to the prosecution, were able to copy files with personal data of passengers. However, neither the content of these files nor the fact of transferring information outside the company’s infrastructure does not consider the protection to be established.
I. R. stated in court that the study of his computer does not confirm the version of the investigation. According to him, in the materials of the case there is no technical evidence that it was the accounts stored on the device that opened the way for attackers to the Leonardo.
A. K. also denied the accusations. He said that after being appointed to a senior position in April 2022, he participated in strengthening the protection of the system. The inspection conducted in November 2023, according to him, did not reveal serious claims to the implemented measures, and some of them the company continues to use until now.
During the attack, experts found an infection and stopped its spread, says the former vice president. He also stated that the server to which the files could be copied was in Moscow, and the temporary data was deleted automatically.
A. K. separately challenged the conclusion about the leakage of personal data. Investigators, in his opinion, only assume that the copied files contained information about the passengers, but did not confirm this with an examination.
The first trial ended in October 2025. I. R. and A. K. paid “Siren-Travel” 1.5 million rubles, apologized and concluded a settlement agreement with the company. The court took into account the reparations, reconciliation of the parties and the absence of criminal records, after which he stopped the criminal prosecution.
The prosecutor's office sought to cancel this decision. Representatives of the supervisory authority pointed out that the payment of money to the company does not eliminate possible damage to the interests of the company and the state. The appeal upheld the decision, but the Second Court of Cassation of General Jurisdiction agreed with the arguments of the prosecutor's office and in April 2026 sent the case for a new consideration.
Now the court will have to establish whether violations by former top managers allowed hackers to penetrate Leonardo, what information they could get and whether it is possible to link the actions of the accused with the consequences of the attack.
Separately, the proceedings continue around the property of the group of companies “Sirena-Travel”. In February 2026, the Nikulinskiy court of Moscow at the suit of the Prosecutor General’s Office transferred the property of its beneficiaries to the state. The supervisory authority claimed that the assets were corrupt, they were under foreign control and were associated with the deliberate bankruptcy of a state-owned enterprise.
The case is connected with cyber attacks that affected the infrastructure of “Siren-Travel” in the fall of 2023. Due to failures in Leonardo, airlines and airports had problems with passenger registration and baggage.
The criminal case was opened in November 2023, and in the spring of the following year. R. and A. K. Detained. At first, they were imputed to implicitly exposure to critical information infrastructure, but later the investigation changed the article. Now former managers are accused of violating the rules of operation and storing protected computer information, which entailed serious consequences.
I. R. was engaged in the technical development of Leonardo. A. K. was responsible for information security and personal data protection.
According to the prosecution, the attackers gained control over the computer I. R. in the period from August 25 to September 15, 2023. The device allegedly stored the login and password from the booking system, although internal rules forbade to leave such data on a working computer.
The investigation believes that the attackers infected the device with malware, used the found details and penetrated into the internal systems of the company. A. K. is accused of not organizing the necessary measures of the defense, although this was part of his duties.
After the entry, the hackers, according to the prosecution, were able to copy files with personal data of passengers. However, neither the content of these files nor the fact of transferring information outside the company’s infrastructure does not consider the protection to be established.
I. R. stated in court that the study of his computer does not confirm the version of the investigation. According to him, in the materials of the case there is no technical evidence that it was the accounts stored on the device that opened the way for attackers to the Leonardo.
A. K. also denied the accusations. He said that after being appointed to a senior position in April 2022, he participated in strengthening the protection of the system. The inspection conducted in November 2023, according to him, did not reveal serious claims to the implemented measures, and some of them the company continues to use until now.
During the attack, experts found an infection and stopped its spread, says the former vice president. He also stated that the server to which the files could be copied was in Moscow, and the temporary data was deleted automatically.
A. K. separately challenged the conclusion about the leakage of personal data. Investigators, in his opinion, only assume that the copied files contained information about the passengers, but did not confirm this with an examination.
The first trial ended in October 2025. I. R. and A. K. paid “Siren-Travel” 1.5 million rubles, apologized and concluded a settlement agreement with the company. The court took into account the reparations, reconciliation of the parties and the absence of criminal records, after which he stopped the criminal prosecution.
The prosecutor's office sought to cancel this decision. Representatives of the supervisory authority pointed out that the payment of money to the company does not eliminate possible damage to the interests of the company and the state. The appeal upheld the decision, but the Second Court of Cassation of General Jurisdiction agreed with the arguments of the prosecutor's office and in April 2026 sent the case for a new consideration.
Now the court will have to establish whether violations by former top managers allowed hackers to penetrate Leonardo, what information they could get and whether it is possible to link the actions of the accused with the consequences of the attack.
Separately, the proceedings continue around the property of the group of companies “Sirena-Travel”. In February 2026, the Nikulinskiy court of Moscow at the suit of the Prosecutor General’s Office transferred the property of its beneficiaries to the state. The supervisory authority claimed that the assets were corrupt, they were under foreign control and were associated with the deliberate bankruptcy of a state-owned enterprise.
