Cyberattacks and the Vulnerability of Centralized Systems

Recent cyberattacks on water systems in several states reveal the threats to cyber physical systems supporting critical infrastructure. The frequency of these attacks leads most people to overlook them unless they affect their daily lives.

In 2024, there were over 859,000 cyberattacks, averaging nearly 100 per hour. The financial losses from these attacks reached nearly $17 billion in 2024, escalating from $2.7 billion in 2018. Attacks on critical infrastructure numbered nearly 4,900. When Canvas, a learning management system, was crippled by ransomware in May, it affected millions, emphasizing the vulnerability of centralized data management sites.

One impactful area is air travel, affecting over 2.5 million people daily. The system’s reliance on centralized data management, such as airline ticket processing and ground operations, is crucial. The passenger service system oversees passengers’ entire journey, offering services like ticket sales and seat assignments through travel agents.

Centralizing air travel enhances efficiency but also increases vulnerability to cyberattacks. A cyberattack at European airports in 2025 forced a return to manual processing, which would halt the U.S. air system. It would also complicate the Transportation Security Administration’s ability to perform security checks.

Even non-malicious disruptions, such as American Airlines’ computer outage on July 28, showcase system vulnerabilities. A software update bug with CrowdStrike in July 2024 affected Windows operating systems, forcing airlines to use manual check-ins. Delta Airlines estimated a $500 million loss due to affected flights.

Many critical infrastructures use centralized or hybrid management systems, improving oversight yet increasing susceptibility to cyberattacks. For instance, the Federal Reserve, though decentralized, functions as a hybrid system. A compromised sector could delay payments and impede financial activity.

Centralization improves efficiency but introduces risks. Balancing benefits and risks is key in designing complex systems. Our digital economy necessitates constant evaluation of this balance. While benefits frequently materialize, minimizing risks generally prevents severe outcomes. However, negative outcomes occasionally surface, as the Canvas incident demonstrated.

These events, although rare, can be disruptive and costly, particularly for critical infrastructure. This is the tradeoff of participating in a highly connected digital economy, which involves inherent risks largely obscured from everyday understanding.

Sheldon H. Jacobson, Ph.D., is a professor of Computer Science at the University of Illinois Urbana-Champaign. He uses data-driven risk-based decision-making to inform public policy.

Copyright 2026 Nexstar Media Inc. All rights reserved.