Cyberattack Disrupts Major European Airports, Causing Widespread Flight Chaos Between 4 and 6 April, a sophisticated cyberattack targeted a shared IT platform used by airlines and airports across Europe, triggering cascading disruptions at key hubs. The incident paralyzed critical systems including check-in, baggage handling, and boarding at Heathrow, Charles de Gaulle, Frankfurt, and Copenhagen airports, forcing staff to revert to manual processes. The fallout was severe: over 1,600 flights were canceled or delayed on 6 April alone, with airlines activating emergency rosters and passengers advised to arrive early with printed itineraries. While Prague’s Václav Havel Airport was not directly affected, knock-on effects caused delays for several flights on Easter Monday and Tuesday as aircraft and crews were mispositioned. The attack exposed vulnerabilities in aviation’s digital infrastructure, prompting discussions on supply-chain resilience and duty-of-care obligations for businesses. Travel management firms in Prague have since updated contingency plans, recommending flexible bookings, digital visa backups, and buffer days for high-stakes travel. Cybersecurity analysts warn the incident may accelerate EU efforts to include aviation under the Critical Entities Resilience Directive, pushing airports to invest in network segmentation and offline backups. Prague Airport, which already has redundancy plans in its digital transformation strategy, is expected to prioritize these upgrades in response to the disruption.

A cyber attack on Collins Aerospace’s Muse software platform—used for flight check-ins, baggage handling, and boarding coordination—disrupted operations at major European airports, including Heathrow (UK), Berlin (Germany), and Brussels (Belgium). The attack forced airlines to manually process passengers, leading to flight cancellations, delays, and stranded travelers. While Collins confirmed the breach, no details were disclosed regarding the attacker’s identity, motive, or potential customer data compromise. The incident follows geopolitical tensions, with suspicions pointing toward state-backed Russian hackers targeting European infrastructure. Delhi and Bengaluru airports (India), which also use Muse, remained unaffected but are monitoring the situation. The attack highlights vulnerabilities in critical aviation software monopolies, where redundancies are limited, and disruptions cascade globally.

Dublin Airport experienced significant operational disruption due to a Europe-wide cyber attack targeting check-in and boarding systems. As of midday on Sunday, 13 flights (9 inbound, 4 outbound) were cancelled, while airlines in Terminal 2 resorted to manual processes for bag tags and boarding passes, causing delays in check-in and bag drop. The incident forced passengers to allow extra time for procedures, with advisories to contact airlines directly for updates. While no data breach or ransomware was reported, the attack disrupted critical airport infrastructure, leading to financial losses for airlines, reputational damage for the airport, and passenger inconvenience (e.g., missed connections, stranded travelers). The incident also triggered a secondary security alert in Terminal 2 on Saturday, requiring evacuation and intervention by Gardaí and the Defence Forces’ EOD team, though this was later deemed unrelated to the cyber attack. The prolonged system outage highlights vulnerabilities in aviation cybersecurity, affecting thousands of travelers and airline operations across Europe.

Brussels Airport experienced a cyberattack on Friday evening that crippled its passenger and baggage check-in systems, forcing manual processing and causing significant operational disruptions. The attack, which also affected other European airports, targeted a third-party service provider’s systems. As of Saturday, nine flights were cancelled, and 15 departed with delays, with no immediate resolution expected. Passengers were advised to confirm flight statuses before arriving, as the outage led to processing bottlenecks and potential further cancellations. An investigation is underway to assess the full extent of the damage, but the incident has already resulted in financial losses (e.g., compensation, operational costs), reputational harm due to publicized delays, and potential long-term trust erosion among travelers and partners. The attack disrupted critical infrastructure, highlighting vulnerabilities in supply chain cybersecurity and the cascading effects of third-party breaches on large-scale operations.

Ransomware Attack Disrupts Check-In Systems at Major European Airports A ransomware attack targeting Collins Aerospace, a key supplier of automated check-in systems, caused widespread disruptions at several of Europe’s busiest airports on February 10–12, 2026. The incident, confirmed by the EU’s cybersecurity agency (ENISA), locked critical data and forced airports to revert to manual processes, leading to flight cancellations and delays. Affected Airports and Impact - Brussels Airport reported 29 cancellations and only 42% of flights departing on time, with staff using iPads and laptops for manual check-ins. - London Heathrow, Europe’s busiest airport, implemented contingency measures as airlines struggled with system outages. - Berlin Airport, already strained by high passenger volumes due to the Berlin Marathon, faced delays exceeding one hour for departures. - Dublin Airport experienced minimal impact, relying on manual boarding procedures, including handwritten passes. Scope and Response Collins Aerospace, owned by RTX, stated it was working with affected airports to restore full functionality, with updates nearing completion. ENISA confirmed law enforcement involvement but did not disclose the attack’s origin. Sophos threat intelligence director Rafe Pilling noted that while high-profile ransomware attacks are more visible, they are not necessarily increasing in frequency though their disruptive potential remains a growing concern for critical infrastructure. Broader Context The incident underscores the vulnerability of aviation systems to cyber threats. A recent Bitkom survey found ransomware as the most common cyberattack against German companies, with one in seven paying ransoms. Despite the disruption, analysts emphasize that large-scale attacks with physical-world consequences remain rare.

A cyber attack disrupted critical check-in and boarding systems at Heathrow Airport, leading to operational chaos. Around 70 flights were cancelled on Saturday morning, while dozens more faced delays of up to three hours. The outage forced staff to revert to manual check-in and boarding procedures, significantly slowing down passenger processing. The incident also impacted Brussels and Berlin airports, suggesting the breach targeted a shared third-party service provider responsible for automated airport systems. Travel expert Simon Calder warned of potential 'widespread cancellations' due to the ongoing disruption. The attack caused financial losses (refunds, compensations, operational costs), reputational damage (passenger frustration, media coverage), and logistical strain (staff overtime, rescheduling). While no data breach was explicitly reported, the operational halt and cascading delays across multiple airports highlight severe vulnerabilities in aviation infrastructure. The incident underscores risks tied to supply chain cyber attacks, where a single compromised vendor can paralyze major hubs.

Collins Aerospace, a critical supplier in the aerospace and defense industry, fell victim to a ransomware attack that disrupted European airports by targeting its digital supply chain dependencies. The incident, highlighted in ENISA’s Threat Landscape 2025 report, exemplifies how cyber-attacks on high-value vendors can cascade into broader operational failures. While specific details on data compromise were not disclosed, the attack caused significant service outages, delaying flights and grounding operations across multiple airports reliant on Collins’ systems. The disruption underscored vulnerabilities in interconnected OT (operational technology) and supply chain networks, where a single breach can paralyze downstream services. ENISA warned that such attacks exploit critical dependency points, amplifying impact beyond the initial target. The incident aligns with a rising trend of threat actors leveraging ransomware to cripple essential infrastructure, with financial and reputational fallout extending to airlines, passengers, and regulatory bodies. No direct mention of data theft was made, but the operational halt suggests severe financial losses, reputational damage, and potential regulatory scrutiny for failing to secure supply chain resilience.