Collins Aerospace ransomware attack disrupts check-in at European airports
Collins Aerospace's airport check-in system was hit by a cyberattack, causing check-in outages and delays at London Heathrow, Brussels and Berlin airports in September 2025. The European Union Agency for Cybersecurity (ENISA) confirmed the cause was ransomware, and the company worked to restore its airline software. A suspect was later arrested in the UK, and Brussels Airport and the company moved to replace the check-in system.
Key facts
- Affected organization
- Collins Aerospace
- Incident type
- Ransomware
- Occurred / detected
- Not confirmed
- Scale of damage
- Check-in outages and delays at London Heathrow, Brussels and Berlin airports
- Cause / method
- Ransomware attack
- Location
- Other countries
Timeline
- An attack on Collins Aerospace caused outages at Heathrow, Brussels and Berlin airports.
- Delays continued due to the airport check-in system outage.
- The European Union Agency for Cybersecurity confirmed that the airport outages were caused by ransomware.
- Disruption continued at Berlin airport as the company worked to restore its airline software.
- The UK's National Crime Agency arrested a suspect, and Brussels Airport and the company moved to replace the check-in system.
Also affected by this incident
Cyberattack on Heathrow check-in systems delays flights
↳ Knock-on damage from the Collins Aerospace incident · View original incidentImpact: Check-in system disruption and flight delays
Heathrow Airport's check-in systems were affected in the aftermath of the Collins Aerospace incident, causing delays. On September 21, 2025, a warning was issued that disruption to airport operations would continue for a second day.
Related reports: 3 · last report →Cyberattack fallout disrupts operations at Berlin Brandenburg Airport
↳ Knock-on damage from the Collins Aerospace incident · View original incidentImpact: Ongoing disruption to airport operations
Operations at Berlin Brandenburg Airport were disrupted by the fallout from the Collins Aerospace incident. Disruption caused by the cyberattack continued on September 24, 2025.
Read on Reuters ↗
6 related reports
- Airport cyberattack today disrupts Collins Aerospace at London Heathrow Airport; issues reported at Brussels, Berlin airports
- ENISA confirms ransomware behind airport disruptions; delays at Heathrow, Brussels, Berlin continue
- Ransomware Behind Collins Aerospace Hack, ENISA Says
- Three European airports hit by Collins Aerospace "cyberattack"
- Collins Aerospace working on restoring software for airlines hit by cyberattack
- UK NCA make arrest in airline cyberattack as Collins Aerospace ransomware fallout continues
Other incidents at Collins Aerospace
Collins Aerospace cyberattack and separate data theft
Collins Aerospace was hit by a cyberattack linked to disruption at European airports, and the Everest ransomware gang claimed responsibility for the attack. Separately, a 2022 infostealer infection led to another breach, with old passwords and a delayed response cited as enabling the data theft.
Related reports: 4 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.