An alleged cyber-attack on Friday night, September 19th, caused widespread disruption at several major European airports, including London Heathrow, Brussels, and Berlin. The incident targeted Collins Aerospace, a critical service provider for check-in and boarding systems across multiple airlines globally, leading to significant flight delays and cancellations.

Collins Aerospace, whose parent company is RTX (a major defense and aviation firm), confirmed a "cyber-related disruption" to its MUSE software. Initially described as a "technical issue" by some airports, Brussels Airport explicitly stated it was a cyber-attack against their service provider. The disruption forced airports to resort to manual check-in and boarding procedures, exacerbating passenger wait times and frustration.

At London Heathrow, passengers faced extensive queues, some reporting waits of up to three hours for luggage drop-off. The airport advised travelers to check their flight status with their airline before traveling and to arrive no earlier than three hours before long-haul flights or two hours before domestic flights. Additional staff were deployed to assist passengers and minimize inconvenience. Testimonials from stranded passengers, such as Helen Steel who was traveling with a pet, and freelance journalist Tereza Pultarova, highlighted the lack of information, long waits, and emotional distress caused by the situation, with some experiencing multiple gate changes and reports of staff rudeness.

Brussels Airport confirmed multiple flight cancellations and significant delays, noting that only manual check-in and boarding were possible. Ten flights were cancelled and 17 experienced delays of over an hour. Similarly, Berlin Brandenburg Airport reported longer waiting times due to the system provider's issue. However, other major European hubs such as Manchester, Frankfurt, Hamburg, and Zurich confirmed they were not impacted by the attack. EasyJet also stated that it did not expect the issue to significantly affect its flight schedule for the remainder of Saturday.

Speculation is rife that Russia could be behind the cyber-attack. This timing coincides with recent Russian incursions into NATO territories, including violations of Estonian airspace by three MiG-31 fighter jets and a show of force over a Polish oil platform on the same day. Cybersecurity experts, including Rob Jardin of NymVPN, noted Russia's extensive hacking capabilities and history of targeting critical European infrastructure, emphasizing that "geopolitics is increasingly playing out in cyberspace." Collins Aerospace itself has been a target of suspected Russian hackers, such as the ransomware group BianLian in 2023, and The Everest Group, which recently claimed a hack on BMW after targeting Collins.

Aviation and travel expert Paul Charles expressed surprise and shock, calling the attack "very clever" for affecting multiple airlines and airports simultaneously. He highlighted deep concerns about tampering with systems of a company like Collins, which supplies governments worldwide. The incident underscores the growing vulnerability of critical global infrastructure to cyber warfare and the urgent need for enhanced cyber defenses and resilient, decentralized systems to prevent widespread shutdowns.