Major Cyber-Attack Disrupts European Airport Operations, Causing Widespread Flight Delays

Breached Company

21 Sep 2025 — 11 min read

A sophisticated cyber-attack on Collins Aerospace's check-in systems has caused significant disruptions at major European airports, highlighting critical vulnerabilities in aviation infrastructure.

A coordinated cyber-attack targeting Collins Aerospace's passenger processing systems brought chaos to several major European airports on Saturday, September 20, 2025, with London Heathrow, Brussels Airport, and Berlin Brandenburg among the worst affected. The incident has sparked renewed concerns about the aviation industry's vulnerability to digital threats and over-reliance on centralized technology providers.

The Attack Unfolds

The cyber-attack began on Friday night, September 19, when hackers successfully compromised Collins Aerospace's MUSE (Multi-User System Environment) software. This critical system enables multiple airlines to share check-in desks and boarding gates at airports rather than requiring each carrier to maintain its own dedicated facilities.

Collins Aerospace, a subsidiary of RTX (formerly Raytheon Technologies), confirmed it was "aware of a cyber-related disruption" affecting select airports but provided limited details about the nature or perpetrators of the attack. The company emphasized that "the impact is limited to electronic customer check-in and baggage drop and can be mitigated with manual check-in operations."

Widespread Airport Disruptions

Heathrow Airport

Europe's busiest airport experienced significant delays as airlines were forced to switch to manual check-in processes. Passengers reported waiting times of over two hours, with some missing connecting flights. The airport advised travelers to arrive no earlier than three hours before long-haul flights and deployed additional staff to manage the disruption.

British Airways remained largely unaffected as it operates on a backup system, but most other airlines using Heathrow faced operational challenges. By Saturday evening, hundreds of flights had been delayed according to flight tracking services.

Brussels Airport

Belgium's primary airport was among the most severely impacted, with officials confirming that the cyber-attack had a "large impact on the flight schedule." Eurocontrol, Europe's air traffic management organization, asked airlines to cancel half their scheduled flights to and from Brussels between 04:00 GMT Saturday and 02:00 GMT Monday.

Ten flights were cancelled by mid-morning Saturday, with an average delay of one hour for all departing flights. The airport warned passengers of continued delays and cancellations as manual processing significantly slowed operations.

Berlin Brandenburg Airport

German authorities quickly identified the disruption and proactively disconnected affected systems to prevent further compromise. While longer waiting times were reported, the airport managed to avoid major flight cancellations by implementing manual backup procedures.

Other Affected Locations

Dublin and Cork airports in Ireland also reported "minor impact" from the attack, with some airlines implementing manual check-in processes. The disruption's reach demonstrated the extensive interconnectedness of modern aviation systems.

Industry Impact and Response

The attack exposed critical vulnerabilities in the aviation sector's digital infrastructure. Collins Aerospace provides systems to approximately 170 airports globally, meaning a single point of failure could potentially affect millions of passengers worldwide.

Key Government Responses:

Britain's National Cyber Security Centre confirmed it was working with Collins Aerospace and affected airports to understand the incident's full impact
Transport Secretary Heidi Alexander said she was receiving regular updates and monitoring the situation
The European Commission stated there were no indications of a "widespread or severe attack" but investigations were ongoing

Airline Adaptations:

Most major European carriers implemented manual check-in procedures
EasyJet and Ryanair, which don't use Collins Aerospace systems at their primary hubs, reported normal operations
Delta Air Lines and United Airlines experienced minimal impact, implementing workarounds to reduce disruption

Cybersecurity Concerns and Attribution

While no group has claimed responsibility for the attack, cybersecurity experts note several concerning trends:

Rising Aviation Cyber Threats: The aviation sector experienced a staggering 600% increase in cyber-attacks from 2024 to 2025, according to aerospace company Thales. This dramatic surge reflects the industry's increasing digitization and criminals' growing awareness of its vulnerabilities.

Attack Methodologies: Modern cybercriminals are increasingly using social engineering techniques rather than traditional code-based hacking. The FBI has previously warned about groups like "Scattered Spider" targeting aviation companies through sophisticated social manipulation of IT help desks.

Speculation and Investigation: While some unfounded accusations point to state-sponsored actors, most major cyber-attacks in recent years have been perpetrated by criminal organizations seeking financial gain through ransomware or data theft. The investigation into this incident's origins continues.

Passenger Experiences

The human cost of the disruption was evident in passenger testimonies:

Lucy Spencer waited over two hours to check in for a Malaysia Airlines flight, with staff manually tagging luggage and processing passengers via phone
Monazza Aslam sat on the tarmac for over an hour with elderly parents, missing her connecting flight to Doha
Johnny Lal's family missed their flight to Mumbai for a funeral, with disabled relatives unable to access mobility assistance due to system failures

These personal accounts highlight how technical failures translate into real hardship for travelers, particularly vulnerable passengers requiring special assistance.

Systemic Vulnerabilities Exposed

Supply Chain Attack Pattern: The Collins Aerospace incident follows a concerning trend of supply chain cyber-attacks that have plagued critical infrastructure sectors. Similar to the CDK Global attack that paralyzed 15,000 car dealerships in June 2024 (costing $605 million in just two weeks) and the PowerSchool breach that exposed 62 million students' data in December 2024, this attack demonstrates how centralized technology providers become single points of catastrophic failure.

Dangerous Architectural Dependencies: Collins Aerospace's MUSE (Multi-User System Environment) system operates as a cloud-based platform that enables multiple airlines to share check-in infrastructure rather than maintaining dedicated systems. This efficiency-driven approach creates deep integration points where a single compromise can cascade across multiple organizations simultaneously. The attack methodology mirrors other recent supply chain breaches where attackers gained administrative access to vendor systems and then leveraged that access to impact thousands of downstream customers.

Cross-Industry Vulnerability Pattern: The aviation sector's 600% increase in cyber-attacks from 2024 to 2025 reflects a broader trend where criminal organizations specifically target supply chain providers to maximize impact. Like the "always-on VPN" connections that enabled the CDK attack to spread to individual dealerships, Collins Aerospace's integrated airport systems create persistent network pathways that amplify the reach of successful breaches.

Economic Lock-in Amplifies Risk: The prohibitively high "switching costs" of migrating to alternative vendors—including software licensing, staff training, data migration, and process reengineering—trap organizations in dependencies on vulnerable systems. This economic reality enables attackers to demand higher ransoms, knowing that victims have limited alternatives and face business-critical disruptions.

Industry Response and Future Implications

The attack has reignited discussions about aviation cybersecurity and operational resilience, with lessons learned from other major supply chain breaches:

Immediate Measures:

Enhanced monitoring of critical systems and vendor access points
Improved coordination between airports and technology providers
Review of manual backup procedures and capacity, informed by CDK Global's experience where dealerships without backup plans were forced into weeks of manual operations
Emergency response protocols that account for cross-border vendor dependencies

Long-term Strategic Considerations:

Vendor Diversification: Reducing single points of failure by distributing critical functions across multiple providers, similar to strategies being implemented by school districts following the PowerSchool breach
Zero Trust Architecture: Implementing security models that assume no user or device is trustworthy by default, including vendor systems with administrative access
Air-Gapped Backup Systems: Developing manual processes capable of handling full operational capacity, not just emergency procedures
Supply Chain Security Standards: Industry-wide cybersecurity protocols that include mandatory security assessments of critical vendors
Economic Resilience Planning: Strategies to reduce "switching costs" and vendor lock-in that enable attackers to demand higher ransoms

Cross-Industry Intelligence Sharing: The similar attack patterns across aviation (Collins Aerospace), automotive (CDK Global), and education (PowerSchool) demonstrate the need for threat intelligence sharing between sectors. Criminal organizations are clearly studying and replicating successful supply chain attack methodologies across different industries.

Historical Context and Supply Chain Precedents

This incident follows several high-profile supply chain cyber-attacks that have exposed critical vulnerabilities across multiple industries:

Recent Major Supply Chain Breaches:

CDK Global (June 2024): BlackSuit ransomware group compromised the automotive industry's primary dealer management system, affecting 15,000 car dealerships across North America. The attack forced dealerships to resort to manual, pen-and-paper processes for vehicle sales and financing, ultimately costing the industry over $1 billion collectively. CDK paid a $25 million ransom, but the two-week outage demonstrated how a single vendor compromise could paralyze an entire economic sector.
PowerSchool (December 2024): Attackers compromised the education technology giant's customer support portal, stealing personal data from 62 million students and 9.5 million educators across 6,500+ school districts. Despite PowerSchool paying a $2.85 million ransom for alleged data deletion, criminals later launched secondary extortion campaigns against individual school districts, proving that ransom payments offer no guarantee of data protection.
The July 2024 CrowdStrike outage that grounded flights globally due to a faulty software update
Previous targeted attacks on individual airlines including Hawaiian Airlines, WestJet, and KLM

Common Attack Vectors: These incidents share troubling similarities—attackers targeting administrative access to vendor systems, exploiting "always-on" network connections between providers and customers, and leveraging deep system integrations to maximize impact. The aviation sector's reliance on shared infrastructure mirrors the automotive industry's dependence on centralized dealer management systems and education's consolidation around major technology platforms.

Supply Chain Risk Amplification: As industries increasingly consolidate around fewer, more integrated technology providers, the potential for cascading failures grows exponentially. The Collins Aerospace attack specifically highlights how efficiency-driven shared infrastructure—while cost-effective during normal operations—becomes a liability during security incidents.

Aviation expert Anita Mendiratta, special adviser to the UN tourism secretary general, emphasized that this was "a disruption caused to software, not a specific airport," highlighting the importance of "containing the contagion" when technology failures occur.

Looking Forward: Lessons from Supply Chain Cyber-Warfare

As air travel continues to rely increasingly on digital systems, this incident serves as part of a broader pattern of supply chain vulnerabilities that extends far beyond aviation. The systematic targeting of centralized technology providers—whether Collins Aerospace in aviation, CDK Global in automotive, or PowerSchool in education—represents a evolution in cyber-warfare where attackers maximize impact by striking at the digital infrastructure that connects entire industries.

The attack on Collins Aerospace systems represents more than just a technical failure—it's part of a coordinated campaign against supply chain dependencies that have become the Achilles' heel of modern economic infrastructure. Criminal organizations have clearly identified that targeting shared technology platforms yields far greater returns than attacking individual organizations, as demonstrated by the collective billions in damages across these recent incidents.

Critical Infrastructure at Risk: The convergence of these attacks across critical sectors—transportation, automotive, and education—suggests that attackers are systematically mapping and exploiting the centralized dependencies that underpin modern society. As investigations continue into the Collins Aerospace breach, the focus must shift beyond immediate recovery to fundamental questions about how democratic societies can maintain the efficiency benefits of shared infrastructure while defending against adversaries who specifically target these integration points.

The New Cyber Battlefield: These supply chain attacks represent a new phase of cyber-conflict where the battlefield extends beyond traditional cybersecurity perimeters to encompass the vendor relationships, administrative access controls, and economic dependencies that enable modern digital infrastructure. The aviation industry, like automotive and education before it, must grapple with the reality that efficiency and security often exist in tension, requiring new approaches that prioritize resilience alongside operational optimization.

The disruption's resolution timeline remains uncertain, with some impacts expected to continue into Sunday as airports work to clear passenger backlogs and restore normal operations. For travelers, the incident underscores the importance of flexibility and preparation when flying. For policymakers and industry leaders, it represents an urgent call to address the systemic vulnerabilities that enable determined adversaries to inflict cascading damage across critical infrastructure sectors through a single successful breach.