Cyberattack Cripples Major European Airports-Forcing Manual Operations

Cyberattack Cripples Major European Airports-Forcing Manual Operations

Major European airports including London Heathrow, Brussels, and Berlin faced widespread disruptions on September 19-20, 2025, following a sophisticated cyberattack that targeted critical aviation technology systems.

Cyberattack Cripples Major European Airports-Forcing Manual Operations

The Attack

The cyberattack struck late on Friday night, September 19, targeting Collins Aerospace, a subsidiary of RTX Corporation (formerly Raytheon Technologies), which provides check-in and boarding systems to airports across Europe. The attack rendered automated passenger processing systems inoperable, forcing airports to switch to time-consuming manual check-in and boarding procedures.

Brussels Airport confirmed the incident in an official statement: “There was a cyberattack on Friday night September 19 against the service provider for the check-in and boarding systems affecting several European airports including Brussels Airport.” The airport reported a “large impact” on flight schedules, with significant delays and cancellations expected.

Widespread Disruptions

The attack affected some of Europe’s busiest aviation hubs:

London Heathrow warned passengers of potential delays, describing the incident as a “technical issue” affecting electronic check-in and baggage handling systems. The airport deployed extra staff to assist passengers with manual processes.

Brussels Airport experienced severe disruptions, with Eurocontrol requesting airlines to cancel half of their flights to and from Brussels between 4 AM Saturday and 2 AM Monday due to the attack’s impact.

Berlin Brandenburg Airport also confirmed disruptions to its passenger processing systems, joining the list of major hubs affected by the breach.

Passengers at affected airports faced long queues and anxiously monitored announcement boards showing numerous flight delays and cancellations. Airlines advised travelers to check with carriers whether their flights were still scheduled to depart.

Company Response

RTX Corporation acknowledged the breach, stating it had become aware of a “cyber-related disruption” to its software at selected airports. Collins Aerospace, which provides critical aviation technology services to airports worldwide, has not yet disclosed the full extent of the attack or the methods used by the attackers.

The incident highlights the vulnerability of aviation infrastructure to cyber threats, as a single service provider’s compromise can cascade across multiple international airports, affecting thousands of passengers and disrupting global air traffic.

Why Airport Systems Are Vulnerable to Cyberattacks

Airport systems present attractive targets for cybercriminals due to several inherent vulnerabilities and characteristics that make them particularly susceptible to attack:

Interconnected Infrastructure

Modern airports rely on complex, interconnected digital systems that manage everything from check-in and baggage handling to air traffic control and security screening. This interconnectedness means that compromising one system can potentially provide access to others, creating a cascade effect similar to what occurred with the Collins Aerospace attack.

Legacy Systems Integration

Many airports operate a mixture of modern and legacy systems that weren’t originally designed with cybersecurity as a priority. These older systems often lack robust security features and may be difficult to update or patch, creating persistent vulnerabilities that attackers can exploit.

Third-Party Dependencies

As demonstrated by the recent attack, airports heavily rely on third-party service providers for critical operations. Collins Aerospace, for instance, provides check-in and boarding systems to multiple airports across Europe. When such centralized providers are compromised, the impact multiplies across all their clients, creating widespread disruption from a single breach.

Multiple Access Points

Airports must accommodate numerous stakeholders including airlines, ground handling companies, retail operators, security agencies, and government entities. Each requires system access, creating multiple potential entry points for attackers. Managing security across this diverse ecosystem is inherently challenging.

24/7 Operational Requirements

Airports cannot afford extended downtime for maintenance or security updates, as they operate continuously. This creates pressure to maintain systems in operation even when vulnerabilities are discovered, potentially leaving security gaps unaddressed for extended periods.

High-Value Targets

Airport systems contain valuable personal data from passengers, including passport information, travel patterns, and financial details. Additionally, disrupting airport operations can cause significant economic damage and public attention, making them attractive targets for both financially motivated cybercriminals and state-sponsored actors seeking to cause disruption.

Supply Chain Vulnerabilities

The aviation industry relies on a complex global supply chain of technology providers, software vendors, and service companies. As seen with the Collins Aerospace incident, vulnerabilities in any part of this supply chain can have far-reaching consequences across the entire aviation ecosystem.

Regulatory Complexity

Airports operate under multiple regulatory frameworks covering safety, security, and data protection. This regulatory complexity can sometimes create gaps or conflicts in cybersecurity requirements, making it difficult to implement comprehensive security measures.

Conclusion

The September 2025 attack on European airports serves as a stark reminder that critical infrastructure remains vulnerable to cyber threats. The incident demonstrates how a single point of failure in a service provider can cascade across multiple facilities, disrupting international travel and affecting thousands of passengers. As airports become increasingly digitized and interconnected, addressing these fundamental vulnerabilities through better security practices, redundant systems, and improved third-party risk management becomes ever more critical.