Collins Aerospace ransomware attack disrupts check-in at European airports
Collins Aerospace's airport check-in system was hit by a cyber-attack, causing check-in outages and delays at London Heathrow, Brussels and Berlin airports in September 2025. The European Union Agency for Cybersecurity (ENISA) confirmed the cause was ransomware, and the company worked to restore its airline software. A suspect was later arrested in the UK, and Brussels Airport and the company moved to replace the check-in system.
Key facts
- Affected organisation
- Collins Aerospace
- Incident type
- Ransomware
- Occurred / detected
- Not confirmed
- Scale of damage
- Check-in outages and delays at London Heathrow, Brussels and Berlin airports
- Cause / method
- Ransomware attack
- Location
- Other countries
Timeline
- An attack on Collins Aerospace caused outages at Heathrow, Brussels and Berlin airports.
- Delays continued due to the airport check-in system outage.
- The European Union Agency for Cybersecurity confirmed that the airport outages were caused by ransomware.
- Disruption continued at Berlin airport as the company worked to restore its airline software.
- The UK's National Crime Agency arrested a suspect, and Brussels Airport and the company moved to replace the check-in system.
Also affected by this incident
Cyber-attack on Heathrow check-in systems delays flights
↳ Knock-on damage from the Collins Aerospace incident · View original incidentImpact: Check-in system disruption and flight delays
Heathrow Airport's check-in systems were affected in the aftermath of the Collins Aerospace incident, causing delays. On 21 September 2025, a warning was issued that disruption to airport operations would continue into a second day.
Related reports: 3 · last report →Cyber-attack fallout disrupts operations at Berlin Brandenburg Airport
↳ Knock-on damage from the Collins Aerospace incident · View original incidentImpact: Ongoing disruption to airport operations
Operations at Berlin Brandenburg Airport were disrupted by the fallout from the Collins Aerospace incident. Disruption caused by the cyber-attack continued on 24 September 2025.
Read on Reuters ↗
6 related reports
- Airport cyberattack today disrupts Collins Aerospace at London Heathrow Airport; issues reported at Brussels, Berlin airports
- ENISA confirms ransomware behind airport disruptions; delays at Heathrow, Brussels, Berlin continue
- Ransomware Behind Collins Aerospace Hack, ENISA Says
- Three European airports hit by Collins Aerospace "cyberattack"
- Collins Aerospace working on restoring software for airlines hit by cyberattack
- UK NCA make arrest in airline cyberattack as Collins Aerospace ransomware fallout continues
Other incidents at Collins Aerospace
Collins Aerospace cyber-attack and separate data theft
Collins Aerospace was hit by a cyber-attack linked to disruption at European airports, and the Everest ransomware gang claimed responsibility for the attack. Separately, a 2022 infostealer infection led to another breach, with old passwords and a delayed response cited as enabling the data theft.
Related reports: 4 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.