Ransomware Attack on Aviation IT Provider Disrupted European Airports for Days

Travellers across Europe endured a weekend of disruption after a ransomware attack struck one of the aviation industry's most widely used software providers, knocking out electronic check-in and boarding systems at some of the continent's busiest airports.

The attack targeted Collins Aerospace, a subsidiary of US aerospace and defence giant RTX, disabling its widely deployed passenger-processing software. Airports including London Heathrow, Berlin Brandenburg, Brussels and Dublin were forced to revert to manual check-ins, producing long queues, flight delays and cancellations that stretched through the weekend and into the following week.

The European Union Agency for Cybersecurity (ENISA) confirmed to media outlets that ransomware was responsible, describing the event as a third-party ransomware incident. The agency said the ransomware strain had been identified and that law enforcement agencies were investigating.

What happened to Collins Aerospace

Collins Aerospace's Muse software is used by airlines and airports around the world to share check-in desks and boarding gates, rather than relying on dedicated facilities per airline. When the company's systems went down late in the week beginning September 19, that shared infrastructure became a single point of failure across multiple hubs at once.

The company initially described the event only as a cyber-related disruption to its Muse software and said it was aware of the impact on airline and airport operations. In the days that followed, Collins said software updates to restore full functionality were in the final stages, but it did not provide a timeline for complete restoration and did not explain the full scope of the incident.

Reporting by the BBC, based on internal Heathrow crisis communications, suggested the disruption ran deep: recovery work was being carried out in person rather than remotely, and Collins reportedly discovered that the attackers were still inside its network during the rebuild — underscoring how difficult recovery becomes once intruders gain a persistent foothold.

Airports hit and the passenger fallout

London Heathrow said most flights continued to operate but warned passengers that airlines had to use manual procedures, making check-in and boarding slower than usual. The airport advised travellers to check flight status before leaving home and to arrive no earlier than three hours before long-haul departures.

Brussels Airport faced the most severe disruption. Eurocontrol, Europe's aviation regulator, advised airlines to cancel half of their flights to and from Brussels over the weekend, and on the Monday that followed the airport cancelled 40 departing flights and 23 arrivals out of 277 scheduled services. Berlin Brandenburg and Dublin airports also reported delays and manual processing, with Dublin officials remaining on alert for further cancellations.

Airlines felt the impact immediately. Aer Lingus said it had been significantly impacted, and by Sunday British Airways and several other carriers had resumed partial electronic operations using backup systems. The financial fallout was visible too: shares in IAG, easyJet and Wizz Air dipped in early trading as investors weighed the disruption.

What investigators and officials say

ENISA's confirmation settled early speculation about the cause, though the agency said it could not share further information for now and did not disclose the source of the attack. The European Commission said it was closely monitoring the situation and saw no signs of a widespread attack beyond the known incidents.

The question of who was behind the attack remains open. A UK government reviewer of terrorism legislation noted that state-sponsored hackers could plausibly be responsible, while also pointing out that sophisticated private ransomware groups have the capability to carry out such attacks. Authorities have not ruled out either possibility.

For airport operators, the practical warning was stark: a Brussels airport spokesperson said the system was not yet fully secure even as recovery proceeded, and advisories to airlines reportedly instructed staff not to log out of the Muse system if they were already connected, a sign of how fragile the restoration effort was.

The third-party software problem

The incident is a textbook example of supply-chain risk in critical infrastructure. A single technology provider's software underpins operations at dozens of airports, so one compromise cascaded into continent-wide disruption. The World Economic Forum called it an urgent wake-up call for cyber resilience, stressing that organisations must prepare not only to prevent attacks but to keep critical services running when they happen.

What defenders can learn from the disruption

Security teams watching the incident point to several practical lessons. Network segmentation can limit how far intruders move once inside. Offline, tested backups and rebuild procedures matter enormously when attackers maintain a foothold. Incident response plans should include manual fallback procedures — the airports that could process passengers by hand kept more flights moving.

Just as important is scrutinising the security of critical vendors. When a supplier's software is load-bearing for an entire industry, its security posture becomes everyone's problem, and contracts and audits need to reflect that reality.

Why it matters for Pakistan

Pakistan's aviation sector runs on the same global ecosystem of shared passenger-processing and check-in systems. Airports in Karachi, Lahore and Islamabad, along with PIA and international carriers operating in the country, depend on international software providers whose outages do not respect borders.

The episode is a reminder for the Pakistan Civil Aviation Authority and airport operators to rehearse manual fallback procedures, maintain clear passenger communication plans, and assess the concentration risk in their own technology supply chains. For Pakistani businesses more broadly, the lesson is the same: knowing which third-party systems your operations depend on — and what you will do when they fail — is now a basic requirement of resilience.