A cyber attack that crippled operations at a host of European airports on Friday is continuing to cause disruption, with many flights still delayed or cancelled.
Over the weekend, airlines flying out of London Heathrow, Brussels, and Berlin were forced to check passengers in manually following an attack on Collins Aerospace.
The affected software, ARINC cMUSE, allows airlines to share check-in desks and boarding gate positions rather than using their own dedicated infrastructure.
The UK's National Cyber Security Centre (NCSC) said it is working with the company and affected UK airports, together with the Department for Transport and law enforcement agencies, to fully understand the incident and its effects.
Brussels Airport said that around half of outgoing flights today are likely to be affected.
"The service provider is actively working on the issue and trying to resolve the problem as quickly as possible," it said in a statement. "At the moment it is still unclear when the issue will be resolved."
Meanwhile, Heathrow advised, "Work continues to resolve and recover from the outage of a Collins Aerospace airline system that impacted check-in. We apologize to those who have faced delays, but by working together with airlines, the vast majority of flights have continued to operate."
There is of course a knock-on effect on airports not directly affected, with Dublin Airport noting this morning that “ongoing disruption” is affecting check-in and boarding systems.
"The Dublin Airport team is continuing to support airlines today (Monday) as they manage ongoing disruption from a technical issue that is affecting check-in and boarding systems at several airports in Europe."
Passengers told to keep up to date
Passengers are being advised to check the status of their flights before traveling to affected airports and to make sure they arrive in good time – but not too early.
Collins has so far remained tight-lipped about what happened, though it confirmed to Reuters it had experienced a 'cyber-related disruption'.
The aerospace industry has been suffering a wave of cyber attacks over recent months.
In June, a report from Thales found that there had been a 600% increase in ransomware attacks in the aviation sector over the previous year, with 27 major attacks by 22 ransomware groups between January 2024 and April 2025.
Just over seven-in-ten incidents involved credential theft or unauthorised access to critical systems.
However, there's no indication that this particular incident involves a ransom attack. On Saturday, Liberal Democrat foreign affairs spokesperson Calum Miller suggested that Russia might be involved.
"After the flagrant violation of Estonian airspace, the government needs to urgently establish if Vladimir Putin is now attacking our cyber systems," he said.
"If the Kremlin is behind this attack, causing chaos at our busiest airport, we need to be firm in our response."
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
-
AI is transforming Agile developmentNews The influx of AI tools is helping reshape Agile development at a critical juncture for the methodology
-
Dell laptops: Are they worth the investment for business?With optimized hardware for the best performance and battery life, Dell laptops quell common rumors about AI PCs
-
Former NCSC head says the Jaguar Land Rover attack was the 'single most financially damaging cyber event ever to hit the UK' as impact laid bareNews Researchers said they place the UK financial impact of the attack on Jaguar Land Rover at around £1.9 billion.
-
Japan running super dry of its favourite beer as Asahi cyberattack continuesNews Production of Asahi beer, one of the country's favourite beverages, has been halted, and reserves are running low
-
A new 'top-tier' Chinese espionage group is stealing sensitive datanews Phantom Taurus has been operating for two years and uses custom-built malware to maintain long-term access to critical targets
-
Asahi production halted by cyberattackNews Yet another big brand suffers operational disruption following apparent hacking attack
-
Kido nursery hackers threaten to release more details – along with the personal data of 100 employeesNews The attack is the first to be claimed by the new threat group 'Radiant'
