European airports disrupted: the Collins Aerospace cyberattack explained

In September 2025, ransomware hit a Collins Aerospace check-in system and disrupted Heathrow, Brussels and Berlin. How a single supplier threw several airports into manual mode.

On the evening of 19 September 2025, and through the following weekend, several major European airports had to check passengers in by hand. The cause: an attack on MUSE, the shared check-in and boarding software supplied by Collins Aerospace.

What happened

• Heathrow, Brussels and Berlin were among the airports most affected.
• The EU cybersecurity agency ENISA said ransomware was involved.
• In Brussels, many flights were cancelled over several days while systems were restored.
• In the UK, one person was arrested as part of the investigation and later released on bail.

One supplier, many victims

The airports themselves were not directly hacked: a common piece of software, used by many airlines and several airports, was the target. That is how a supply-chain attack works: hit one supplier to reach all of its customers.

Lessons for any business

• List the external services your business depends on: point of sale, booking, payments, hosting.
• Have a manual procedure to keep serving customers if a tool goes down.
• Ask critical suppliers how they protect themselves and how they communicate during an incident.
• Avoid relying on a single tool with no fallback for vital functions.

Fallback mode is a real skill

The airports kept operating thanks to manual procedures. For a business, being able to take an order, confirm a booking or take payment without the usual tool, even slowly, makes all the difference on the day of an outage.

Your security also depends on your suppliers’ security.

Sources: ENISA, BBC, TechCrunch, NBC News, September 2025.

Want a website and bookings that rely less on a single tool? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.