Disruption Continues in Wake of European Airports Cyberattack

The EU’s cybersecurity agency has confirmed ’third party' involvement in the hack on the outsourced systems for check-ins and boarding.

Passengers wait at Heathrow Airport in London. Maja Smiejkowska/PA

Passengers at a number of European airports faced another day of potential disruption on Sept. 22 following a cyberattack that affected check-in and boarding systems over the weekend.

The attack began on the evening of Sept. 19, causing disruption at major international hubs including Brussels, Berlin Brandenburg, and London Heathrow, Europe’s busiest airport.

Responsibility for the attack remains unknown.

Flights were canceled or delayed as the impacted airlines had to carry out check-in and boarding operations manually.

In a statement on Sept. 19, Heathrow said: “Work continues to resolve and recover from an outage of a Collins Aerospace airline system that impacted check-in.

“We apologise to those who have faced delays, but by working together with airlines, the vast majority of flights have continued to operate.”

Brussels Airport, which may have been hit the hardest, continued to experience disruptions on Sept. 22. The airport asked airlines to cancel almost 140 outbound flights—about half of the 276 flights that were scheduled to depart from Brussels that day.

Law enforcement agencies are continuing to investigate.

Speculation

Speculation from some quarters that Russia might have been responsible followed increased concern over aviation safety in Europe after recent incursions from Russian drones into Polish airspace.

However, no evidence that Russia was responsible has been reported at this point. Most recent hacks, including a major attack on British retailer M&S in April, have been attributed to criminal gangs looking to extort large sums of money from major corporations.

The UK National Crime Agency (NCA) charged two teenagers—Thalha Jubair, 19, and Owen Flowers, 18—in connection with a major cyberattack carried out in August 2024 on the Transport for London (TfL) network. The pair are due to appear in court next month.

The NCA said it believes the TfL attack was carried out by members of the cyber-criminal group known as Scattered Spider, a network said to be made up primarily of individuals from the UK and the United States.

‘Third Party’

The European Union’s cybersecurity agency ENISA confirmed on Sept. 22 that the disruption was caused by a “third party” cyberattack, but gave no further details.

Collins Aerospace, whose systems help passengers check themselves in, print boarding passes and bag tags, and dispatch their luggage from a kiosk, cited a “cyber-related disruption” to its Multi-User System Environment software at “select airports.”

Collins, an aviation and defense technology company that is a subsidiary of RTX Corp., formerly Raytheon Technologies, said it was “actively working to resolve the issue and restore full functionality to our customers as quickly as possible.”

“The impact is limited to electronic customer check-in and baggage drop and can be mitigated with manual check-in operations,” it said in a statement.

The European Commission, which takes part in managing airspace across Europe, said it is monitoring the situation but added there were no signs the alleged cyberattack was “widespread or severe.”

Share Prices Affected

Shares in London-listed airline companies were lower on the morning of Sept. 22 following the disruption.

British Airways owner International Consolidated Airlines Group (IAG), which has primary bases at Heathrow and Gatwick airports, saw its shares slide by 1.3 percent as trading for the week opened.

Elsewhere, budget rivals EasyJet and Wizz Air saw their shares drop by 1.3 percent and 1.5 percent, respectively.

Passengers at Heathrow have been advised to check their flight status before traveling and to arrive at affected airports no earlier than three hours before long-haul flights and two hours before short-haul flights.

The Associated Press and PA Media contributed to this report.