Several major European airports, including Heathrow, Brussels, and Berlin, experienced significant disruptions due to a cyberattack targeting Collins Aerospace’s MUSE software system, which supports electronic check-in and baggage handling. The attack, which occurred on the night of September 19 and into September 20, 2025, forced many airlines to revert to manual check-in and boarding procedures, causing widespread flight delays and cancellations.

Heathrow Airport, as Europe’s busiest hub, reported delays mainly due to the technical failure affecting electronic check-in and baggage drop systems. The airport warned passengers of possible delays and advised travellers to check their flight status and arrive no earlier than three hours before long-haul flights or two hours before domestic flights. While British Airways operated normally using a backup system, most other airlines at Heathrow were impacted, resulting in long queues and frustrated passengers. For example, one traveller recounted waiting over two hours while staff manually tagged luggage and checked in passengers over the phone, only for boarding passes on phones to malfunction at the gates.

Brussels Airport saw one of the most severe impacts, with significant cancellations and a large-scale reduction in flights for the following days. Eurocontrol, Europe’s combined aviation safety organisation, reported that airlines were requested to reduce flight schedules by half from early Saturday through to Monday to help manage the disruption. Berlin Brandenburg Airport and Dublin and Cork airports also confirmed delays and manual processing due to the cyberattack.

The parent company RTX, which owns Collins Aerospace, acknowledged the incident as a “cyber-related disruption” affecting “select airports” and confirmed work was underway to resolve the issue swiftly. The company emphasised that manual operations could mitigate the impact despite outages in electronic systems. However, details about the nature or origin of the attack have not been disclosed by RTX or Collins Aerospace.

The attack highlights the aviation sector’s vulnerability, as much of modern airport operations depend heavily on centralised digital platforms like MUSE. Experts suggest the attack could have been carried out by sophisticated cybercriminals or possibly state-sponsored actors, although such claims remain speculative at this stage. Previous attacks in recent years mostly involved criminal groups focused on extortion via ransomware, extracting cryptocurrency ransoms by locking systems or stealing data.

This incident evokes memories of a global IT disruption in September 2024 caused by a faulty software update, which led to widespread grounding of flights in the US, underscoring how heavily reliant the sector is on technology and how a cyberattack can cascade into major logistical chaos.

Passengers affected by the latest attack described delays ranging from hours in queues to missed connections and lack of essential services such as mobility aids. Heathrow staff have reportedly increased personnel at check-in areas to manage crowds and expedite processing as efficiently as possible under manual conditions.

Transport Secretary Heidi Alexander confirmed government awareness of the cyberattack, stating she was receiving regular updates and monitoring the situation closely. Despite the scale of the disruption, airlines like EasyJet and Ryanair, which do not primarily operate from Heathrow, reported normal operations.

As investigations continue, the aviation industry faces renewed pressure to bolster cyber resilience amid increasing digitalisation, to prevent such attacks from causing severe operational and passenger impacts in the future.

📌 Reference Map:

Source: Noah Wire Services