Recent cyberattacks on water systems in several states demonstrate the risks posed to cyber physical systems that support critical infrastructures. Cyberattacks have become common enough that most people do not take much notice when one occurs, unless it affects them directly.
In 2024, there were over 859 thousand cyberattacks, or nearly 100 per hour on average, with financial losses in 2024 alone amounting to nearly $17 billion, up from $2.7 billion in 2018. Amongst all these cyberattacks, nearly 4,900 were against critical infrastructures that support our physical and digital economy. However, when Canvas, a learning management system used by K-12, colleges and universities, and corporate training centers to coalesce and deliver educational materials remotely and as well to support in-person delivery, was crippled in May by a ransomware cyberattack, its impact on millions of people could not be ignored.
Cyberattacks highlight which centralized data management sites can cripple critical infrastructure, affecting service for millions of people.
One that impacts over 2.5 million people every day is air travel, a system that relies on highly centralized data management, including how airline tickets are processed, how crews are scheduled, and how airplane ground operations are executed. The passenger service system, which includes the airline reservation system, oversees the entire life cycle of air passengers.
These systems have evolved over time, increasing in both functionality and complexity. For example, these systems allow travel agents to sell tickets and assign seats on airplanes. Centralizing air travel management makes the entire air travel system more efficient and fluid. However, such centralization also makes it more vulnerable to cyberattacks that can bring air travel to a standstill.
Recall that air travel was disrupted at several European airports in 2025 when a cyberattack made it necessary to manually process travelers. Returning to such a manual paper model for processing the roughly 2.5 to 3 million passengers who travel each day in the U.S. would bring the air system to a halt. It would also make it more difficult for the Transportation Security Administration to perform the necessary checks on travelers, weakening the aviation security infrastructure that is relied upon to keep the national airspace system secure.
Even a seemingly benign computer outage, like what happened with American Airlines on July 28, demonstrated how vulnerable cyber physical system have become, even if disruptions occur without nefarious intent.
A widespread disruption occurred with the CrowdStrike software update bug in July 2024. Given its impact on Windows operating systems, airlines were forced to resort to manual check-in processes for flights and using paper tickets. Delta Airlines estimated that the cost of the disruption to them alone was around $500 million, given the number of flights affected and the cost of refunds that it was forced to issue as flights had to be cancelled.
This disruption was not a cyberattack, but rather, an operating system update bug for the CrowdStrike security software. Nonetheless, such “friendly fire” wreaked substantial economic and operational damages for thousands of organizations, demonstrating the impact of a centralized data management system disruption.
Numerous other critical infrastructures use centralized management systems or hybrid variations. Such systems make the oversight of these infrastructures more efficient. They also make them more susceptible to cyberattacks, with the potential to temporarily disable components of our digital economy. For example, the Federal Reserve is decentralized across 12 Federal Reserve banks across the nation. Yet many financial transactions pass through the Federal Reserve system, making it a hybrid centralized system. If any sector of this network is compromised, payments may get delayed and financial activity can be slowed.
Centralization has the potential to enhance efficiency. It also creates vulnerabilities. The tradeoff between benefits and risks is at the fulcrum of how complex systems are designed and operate. Our digital economy demands that this tradeoff be measured constantly.
The good news is that the benefits are often accrued frequently, while efforts to minimize the risks typically prevent the worst outcomes from occurring most of the time. However, as was experienced with Canvas, bad outcomes do eventually surface.
This is the price for enjoying the benefits of a highly connected digital economy, which most of us freely participate in, and which we have become accustomed to paying for, even if we do not fully understand its full cost and the risks that are persistently present.
Rare events, by their very nature, do not occur often. Yet when they do occur, their impact can be highly disruptive and costly. With critical infrastructures in our digital economy, they can be debilitating.
Sheldon H. Jacobson, Ph.D., is a professor of Computer Science at the University of Illinois Urbana-Champaign. He applies his expertise in data-driven risk-based decision-making to evaluate and inform public policy.
Copyright 2026 Nexstar Media Inc. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.
