Transportation Dept. Allows Airlines to Skip Meal and Hotel Vouchers After Cyber‑Related Delays

The U.S. Department of Transportation announced a regulatory change that will take effect next month, permitting airlines to deny meal and hotel reimbursements when flights are canceled or delayed due to a cyberattack.

The rule, issued as part of a broader set of passenger‑rights guidelines released last week, clarifies that carriers are not obligated to provide the customary compensation when the disruption stems from a computer‑system breach. The agency says the adjustment reflects the growing frequency of cyber incidents that can cripple reservation and check‑in platforms without directly impacting the safety of the aircraft.

Under existing regulations, airlines must offer affected travelers meals, lodging and transportation when a disruption is caused by mechanical failures, weather or air traffic control issues. The new language creates an explicit exception for cyber‑related events, arguing that such attacks are fundamentally different in nature and often beyond the airline’s immediate control.

Industry groups have welcomed the clarification, noting that the cost of providing accommodations after a ransomware strike or data‑theft incident can be substantial. They also point out that many cyber incidents result in temporary system outages rather than a full grounding of aircraft, and that passengers typically have the option to rebook on later flights.

Consumer advocates, however, warn that the rule could leave travelers stranded without assistance, especially if an airline’s systems are knocked offline for an extended period. They argue that the expectation of basic support—food and a place to stay—has become a standard part of the airline contract of carriage, regardless of the cause of the disruption.

The Transportation Department emphasized that the policy does not affect other passenger‑rights protections, such as refunds for unused tickets. It also noted that airlines must still provide clear communication about the cause of a delay or cancellation and offer alternative transportation when feasible.

As cyber threats continue to evolve, the decision signals a shift toward treating digital attacks as a distinct category of operational risk. Observers suggest that the rule may prompt airlines to invest more heavily in cybersecurity defenses, while also sparking further debate over the balance between corporate liability and passenger welfare in an increasingly connected travel ecosystem.