Airlines Forced to Close Websites? The Real Story

No, airlines are not being forced to close their websites. This misconception stems from a 2025 European Union regulation (the Digital Operational Resilience Act, or DORA) that imposes strict cybersecurity requirements on financial entities, including some airline-owned payment and booking systems. Airlines must comply with these rules, but compliance means upgrading security and reporting protocols, not shutting down their online operations.

Background: Where Did This Idea Come From?

The rumor appears to originate from a misunderstanding of DORA, which took full effect on January 17, 2025. DORA applies to financial institutions operating in the EU, and it also covers third-party technology providers that support them. Many airlines offer financial services—co-branded credit cards, loyalty points that function as currency, or payment processing. Because of these activities, some airline subsidiaries fall under DORA’s scope.

DORA’s goal is to prevent cyberattacks from disrupting the financial sector. It requires companies to:

• Conduct regular penetration testing and vulnerability assessments
• Report major ICT (information and communication technology) incidents within strict timeframes
• Manage third-party vendor risks, including cloud providers and payment gateways
• Maintain business continuity plans for cyber incidents

None of these requirements mandate closing websites. In fact, DORA explicitly expects services to remain operational and resilient.

How DORA Actually Works

DORA applies to a defined list of financial entities: banks, investment firms, insurance companies, payment processors, and crypto-asset service providers. Airlines themselves are not on that list. The only way an airline is affected is if it has a subsidiary that is a financial entity. For example, if an airline operates its own payment institution or e-money institution, that subsidiary must comply.

The regulation also covers critical third-party ICT providers. If an airline’s booking system uses a cloud service that is designated as critical by EU regulators, that provider must meet DORA standards. This is a supply-chain security measure, not a shutdown order.

Compliance involves:

1. Mapping all ICT assets and dependencies
2. Implementing continuous monitoring and threat detection
3. Testing response plans at least annually
4. Contracting with third parties that meet DORA’s security requirements

Non-compliance can result in fines, but the regulation does not include a provision to force closure of a website. Even in the most extreme scenario, regulators could restrict a financial service, not the airline’s public-facing booking site.

What Would Actually Force a Website to Close?

While DORA won’t shut down airline websites, there are real scenarios where a website might be taken offline temporarily:

• Cyberattack: A severe DDoS or ransomware attack might force a company to take its site down to protect data.
• Legal order: A court could order a site closed if it is found to be selling illegal goods or violating consumer protection laws.
• Payment processor termination: If an airline loses its credit card processing ability, it might temporarily suspend online sales.
• Technical failure: A critical infrastructure failure could lead to a temporary outage.

None of these are caused by DORA. They are rare, temporary, and not unique to airlines.

Common Problems and Misconceptions

The most common misconception is that DORA applies to all airlines. It doesn’t. Only airline-owned financial subsidiaries are in scope. Many airlines use third-party payment processors, which are separately regulated.

Another misconception is that DORA requires companies to stop using cloud services. It does not. It requires that cloud contracts include specific security provisions and that the airline monitors the provider’s compliance. This is a contractual and technical upgrade, not a ban.

Some headlines also confuse DORA with the EU’s NIS2 Directive, which applies to critical infrastructure sectors including transport. NIS2 does apply to airlines, but it also focuses on cybersecurity measures and incident reporting, not website shutdowns. Both regulations share the same spirit: make digital systems harder to breach and faster to recover.

How Airlines Are Responding

Major airlines with EU operations are treating DORA as a compliance project. They are:

• Auditing their ICT systems against DORA’s requirements
• Updating contracts with technology vendors
• Expanding their security operations centers
• Conducting tabletop exercises to test incident response

These steps are costly and time-consuming, but they do not involve removing websites. In fact, DORA encourages companies to maintain robust digital channels so that customers can still access services during a cyber incident.

Costs and Consequences of Compliance

Compliance costs are significant. Estimates for financial institutions range from hundreds of thousands to millions of euros, depending on size. Airlines with financial subsidiaries will incur similar costs. These may be passed on to consumers through higher fees or reduced loyalty program benefits, but not through website closures.

There is also a risk of fines. DORA allows regulators to impose penalties of up to 2% of worldwide annual turnover for serious violations. However, fines are a last resort. Regulators prefer to work with companies to fix gaps.

Frequently Asked Questions

Does DORA apply to all airlines?

No. DORA applies only to financial entities operating in the EU. Airlines that do not have a financial subsidiary (like a payment institution) are not directly covered. However, if an airline uses a critical cloud provider that is in scope, that provider must be DORA-compliant.

Could an airline website be temporarily closed during DORA compliance?

Unlikely. DORA requires companies to maintain business continuity. A temporary shutdown might occur if a company discovers a critical vulnerability and needs to patch it, but that is standard practice and not a DORA mandate.

What happens if an airline doesn’t comply with DORA?

Regulators can impose fines, require corrective action, or restrict certain financial services. They cannot order a website to be permanently closed. The goal is to improve resilience, not to punish companies.

Is DORA the same as NIS2?

No, but they are related. NIS2 applies to critical infrastructure sectors, including transport, and has broader cybersecurity requirements. DORA is specific to the financial sector. Airlines may need to comply with both, but neither requires website shutdowns.

Where can I check if an airline is DORA-compliant?

There is no public registry. Compliance is monitored by national financial regulators. You can check an airline’s annual report or investor relations page for statements about DORA compliance, but this is not mandatory public disclosure.

Why did this rumor start?

It likely started from a misinterpretation of DORA’s scope. Some news outlets reported that “airlines” were included, without clarifying that only their financial arms were affected. Social media amplified the claim, leading to the false idea that websites would be shut down.

Related

• PPM Error Calculator for Mass Spectrometry
• Voltage Conversion Calculator: Volts, Millivolts and More
• Natural Gas Heating Cost Calculator: Estimate Your Bill