The European Union Agency for Cybersecurity, ENISA, said in a statement that the type of ransomware had been identified and law enforcement was investigating.

US defense contractor RTX, formerly Raytheon, said the attack had affected automatic check-in software called Muse supplied by its subsidiary, software maker Collins Aerospace, to several airline customers.

Software compromise

In a statement on Monday, the company said it was working with four affected airports and airline customers, and was in the final stages of completing the updates necessary to restore full functionality.

An internal memo sent to Heathrow staff says that following the Friday attack, Collins rebuilt its systems and relaunched them, only to realise the hackers still had access to the system, the BBC reported.

The memo reportedly says that more than a thousand computers may have been “corrupted” and work to bring them back online is being done in person and not remotely, slowing down the process.

Airline staff have turned to manual check-in methods to keep flights operating while the Muse software is not functioning.

Heathrow said on Sunday it was working to resolve the issue and apologised to customers over flight delays.

It said the “vast majority” of flights have continued to operate and advised passengers to check the status of their flight before travelling to the airport.

About half the airlines flying from Heathrow were back online by Sunday, according to media reports. British Airways has reportedly been operating on a back-up system since Saturday.

Ongoing disruption

Airports in Brussels, Dublin and Berlin have also experienced delays, with automated check-in systems such as kiosks and bag-drop machines offline.

A spokesperson for Brussels airport said Collins Aerospace had not yet confirmed the Muse system had been secured.

A Berlin Airport spokesperson said some airlines were still boarding passengers manually and there was no indication of when the Muse outage would end.

Some 40 of 277 of the departing flights at Brussels were cancelled on Monday, with 23 of 277 incoming flights cancelled.

The attack is the latest to raise questions over the security of critical systems that are provided by suppliers, and are not under a company’s direct control.

A Heathrow spokesperson said: “This system is not owned or operated by Heathrow, so while we cannot resolve the IT issue directly, we are supporting airlines and have additional colleagues in the terminals to assist passengers.”

Supply-chain hacks

Hackers frequently invade a company’s system by targeting a subcontractor, such as an outsourced IT helpdesk.

In the case of Marks & Spencer, whose online ordering systems were disabled for weeks after a cyber-attack earlier this year, hackers tricked a third-party contractor into providing access to internal systems, the company said in May.

At the time Reuters cited an unnamed source as saying that M&S’ outsourced helpdesk provider Tata Consultancy Services, or TCS, was a “means of access”.

Two other British companies hacked this year, the Co-op and Jaguar Land Rover, whose plants are currently still shut down , also use TCS as a supplier. TCS has denied its systems were breached in the M&S hack.

In 2020, US company SolarWinds said malware was inserted into its Orion security software in a Russian cyber-espionage campaign, leading to a breach of US government agencies including the Department of Justice and the Pentagon.

Credits: Europe

The post Ransomware Attack Disrupts Air Traffic Across Europe first appeared on AircrewNews.com.

The attack crippled digital check-in, baggage drop, and boarding systems, forcing airlines to revert to manual processes. This led to long queues, flight delays, and cancellations, affecting thousands of passengers.

The chaos continued into September 21, with recovery efforts still underway.

September 20: The Cyberattack Hits

Saturday September 20, 2025, saw significant operational turmoil. Across Heathrow, Berlin, and Brussels, a total of 35 departures and 25 arrivals were cancelled, according to Cirium data.

Brussels faced the brunt with 15 cancellations, followed by Heathrow with 13, and Berlin with 7. For context, Heathrow had 651 scheduled departures, Brussels had 228, and Berlin had 226.

The disruptions stemmed from a “cyber-related disruption” in Collins Aerospace’s MUSE system, a critical tool for airport operations. While air traffic control and flight safety remained unaffected, manual check-ins doubled processing times, leading to severe congestion.

At Heathrow, passengers reported three-hour baggage queues and hand-written tags. Berlin saw extended wait times, while Brussels warned of a “large impact” on schedules.

Collins Aerospace, a subsidiary of RTX Corporation, quickly acknowledged the issue and began containment efforts. The company disconnected affected systems to limit the attack’s spread, but this slowed operations further.

The UK’s National Cyber Security Centre (NCSC), along with Belgian and German cyber agencies, stepped in to assist.

No official attribution for the attack—whether ransomware, DDoS, or state-sponsored—has been confirmed. Some have speculated a link to Collins’ recent NATO contract for electronic warfare software.

September 21: Ongoing Disruptions

On September 21, 2025, the fallout persisted. So far, 38 departures and 33 arrivals have been cancelled across the three airports.

Heathrow, with 673 scheduled departures, continues to struggle, while Brussels (256 departures) and Berlin (270 departures) face similar challenges.

Brussels has been hit hardest, with airlines asked to cut 50% of flights for Sunday and Monday—potentially 140 cancellations.

Recovery hinges on a secure software patch, but no timeline has been confirmed. Passengers are advised to arrive three hours early, especially for long-haul flights, and to check airline apps for updates.

Rising Concern of Cyberattacks

This cyberattack highlights the vulnerability of centralized aviation tech. Collins Aerospace serves numerous airlines globally, making it a prime target.

A single breach can ripple across continents, as seen here. The aviation sector has faced a 600% surge in cyberattacks from 2024 to 2025, per industry reports.

This incident, while not “widespread or severe” according to the European Commission, exposes the risks of digital reliance.

Manual backups mitigated some damage, but inefficiencies caused chaos. Travelers faced hours of delays, missed connections, and frustration, underscoring the need for robust cybersecurity.

Looking Ahead

Airports are working to restore normalcy, but disruptions may linger into Monday. Brussels’ request for flight reductions signals ongoing strain. Passengers should monitor flight statuses closely, arrive early, and expect manual processes.

Airlines are offering rebooking options, but demand is high. The NCSC and Collins are collaborating to resolve the issue, with investigations into the attack’s origins ongoing.

As aviation leans on technology, safeguarding systems like MUSE is critical to avoid future chaos.

Credits: European Airports

The post Cyberattack Disrupts Major European Airports: Heathrow, Berlin and Brussels first appeared on AircrewNews.com.