State audit sheds light on cyberattack, vulnerabilities at Salt Lake City airport

SALT LAKE CITY — A new state legislative audit sheds light on a cyberattack at Utah’s largest airport a little more than a year ago, but state legislative auditors and Salt Lake City officials appear to be at odds on some of the report’s findings.

“We found many areas of improvement in our risk assessment that require attention and improvement,” said Kade Minchey, Utah auditor general, adding that he’s concerned that the city “will not take recommendations seriously that aren’t related to cybersecurity.”

Salt Lake City officials, on the other hand, felt the report “leans heavily into criticizing” airport and city leadership rather than addressing the airport’s cybersecurity readiness.

A 2024 attack

State officials requested the audit in 2025, months after Salt Lake City International Airport was the subject of a cyberattack, which appears to have been mostly kept under wraps since it happened.

The December 2024 attack zeroed in on one of the airport’s networks that manages the facility’s system controls, such as its ventilation and paging network, according to a background summary compiled by the city. State officials say the hackers “compromised” multiple administrator accounts and created new accounts.

The attackers installed ransomware that temporarily locked airport staff out of multiple systems and were apparently preparing to steal sensitive data until Utah Cyber Center and Salt Lake City information technology experts helped resolve the situation.

It ultimately resulted in “minimal impact.” No personal identifying information or other valuable data was exfiltrated, wrote Rachel Otto, chief of staff for Salt Lake City’s Mayor’s Office, in a letter about it.

Airport leaders made “several necessary personnel changes” after the incident, including working with the Salt Lake City Information Management Systems Department, to “correct vulnerabilities and ensure that the SLCIA cybersecurity defenses are robust,” she added. The two sides have worked closely ever since to avoid a repeat incident.

“While it is important to emphasize that cybersecurity is a constantly evolving landscape where more can always be done, we have committed significant resources in terms of dollars, personnel and management to protect the SLCIA environment … (The) triggering event was unfortunate, but has made us stronger,” Otto wrote.

However, state legislative auditors say it also “put critical systems and sensitive information at risk,” which they said is concerning because the airport serves as a vital transportation and economic hub in Utah.

An ‘insufficient’ system

The airport’s cybersecurity controls were “insufficient and did not appear to meet federal requirements” before the attack, creating vulnerabilities, the report states. These include best practices outlined by the Transportation Security Administration, although the city asserts that it followed three of four guidelines that the agency recommended at the time.

A cybersecurity tool the city recently installed with federal and state funds helped prevent further damage by alerting to the attack. Experts from the Utah Education and Telehealth Network found that the airport has improved its cybersecurity since the attack, which was one of the audit’s aspects.

Still, the team suggested that the airport is still “lagging” and must strengthen its cybersecurity controls and processes to mitigate future risks.

Auditors add that “shortcomings in governance and leadership” allowed these vulnerabilities to exist, including the attack that happened. They recommend regular airport cybersecurity reporting to city leadership and evaluating the organizational structure to ensure IT and maintenance needs are met.

They outlined three key findings and four recommendations in their report.

Key findings

• Inadequate leadership and governance directly contributed to unaddressed cybersecurity risks.
• Leadership did not fulfill basic responsibilities which enabled poor coordination between critical divisions at the airport
• Internal audit effectiveness depends on good governance and leadership

Top recommendations

• The Salt Lake City Airport should adopt best practices that mitigate risk from external vendors and address other issues identified by the Utah Education and Telehealth Network security team.
• The Salt Lake City Airport should develop a process for systematically mitigating cybersecurity risk. This process should include regular risk assessments and evaluations on the effectiveness of existing controls.
• Salt Lake City should hold the Salt Lake City airport accountable for implementing effective cybersecurity controls. This should include regular reporting on cybersecurity by the airport to Salt Lake City leadership.
• The Salt Lake City Airport executive director should hold airport division directors accountable for implementing audit recommendations. This should involve regular updates between the executive director and division directors on audit recommendations. These efforts should be in support of a culture that values the work of internal auditing.

While auditors said the airport has taken “meaningful steps” to improve security, they warn that “important gaps in governance, risk management and coordination” still exist. They say addressing these issues and following the best cybersecurity practices are “critical to sustaining recent improvement.”

The report adds that “airport leadership needs to take risk management seriously” to avoid future disruptions and data leaks, which could have devastating impacts on the state’s economy. They called on Salt Lake City airport director Bill Wyatt to push division directors to implement changes recommended in the report.

The city responds

Salt Lake City, which was given a copy of the report in advance, does agree with some of the report’s findings, Otto wrote. These include the need to establish “stronger governance through written cybersecurity implementation and response protocols,” and holding division directors accountable. It’s something the city is currently focused on within a field that is “constantly and rapidly evolving.”

Yet, the city felt the report was vague, offering “minimal discussion” on the state of the airport’s cybersecurity readiness, which it wanted from the report.

“Instead, the report leans heavily into criticizing (airport) leadership, and city leadership by extension, and meanders outside the purported scope of the audit by dedicating a significant volume of text on mischaracterizing (the airport’s) use of internal audit,” she wrote, adding that the city received the Utah Education and Telehealth Network’s review findings this month, much later than the audit draft, delaying its ability to review and implement recommendations.

Minchey wrote that he’s concerned that the city appeared to shift blame to a previous IT director while absolving city and airport leadership of responsibility for problems that existed at the time and that auditors believe exist today.

“We found many areas of improvement in our risk assessment that require attention and improvement,” he wrote. “We believe the city is short-sighted for trying to exclude these improvements for ‘scope’ reasons.”