Cyberattack causes a flight delay? Airlines won’t owe you a hotel or meal
A new DOT rule exempts airlines from providing meal vouchers or hotels for cyberattack-caused delays if carriers comply with applicable cybersecurity regulations.
A Department of Transportation rule published in September 2026 adds "cybersecurity attacks" to a list of 10 "not controllable" flight disruption causes, creating a new delay tracking category and relieving compliant airlines of customer service obligations like meal vouchers and hotels. The rule stems from the FAA Reauthorization Act of 2024 and applies only when carriers demonstrate compliance with applicable cybersecurity regulations. Consumer groups reacted cautiously: FlyersRights criticized the lack of public comment, while the National Consumers League saw both certainty benefits and risks from ambiguous wording. The article cites prior aviation incidents including Scattered Spider's airline attacks and the 2024 Collins Aerospace hack that disrupted European flights.