Cyberattack Disrupts Major European Airports, Causing Widespread Flight Chaos Between 4 and 6 April, a sophisticated cyberattack targeted a shared IT platform used by airlines and airports across Europe, triggering cascading disruptions at key hubs. The incident paralyzed critical systems including check-in, baggage handling, and boarding at Heathrow, Charles de Gaulle, Frankfurt, and Copenhagen airports, forcing staff to revert to manual processes. The fallout was severe: over 1,600 flights were canceled or delayed on 6 April alone, with airlines activating emergency rosters and passengers advised to arrive early with printed itineraries. While Prague’s Václav Havel Airport was not directly affected, knock-on effects caused delays for several flights on Easter Monday and Tuesday as aircraft and crews were mispositioned. The attack exposed vulnerabilities in aviation’s digital infrastructure, prompting discussions on supply-chain resilience and duty-of-care obligations for businesses. Travel management firms in Prague have since updated contingency plans, recommending flexible bookings, digital visa backups, and buffer days for high-stakes travel. Cybersecurity analysts warn the incident may accelerate EU efforts to include aviation under the Critical Entities Resilience Directive, pushing airports to invest in network segmentation and offline backups. Prague Airport, which already has redundancy plans in its digital transformation strategy, is expected to prioritize these upgrades in response to the disruption.

The Everest ransomware group breached Dublin Airport, claiming to have stolen approximately 1,533,900 passenger records, including highly sensitive travel and personal data. The compromised information covers full names, flight details (dates, seat numbers, flight numbers, departure/destination codes), frequent flyer data, baggage tags, boarding pass timestamps, check-in device IDs, and verification statuses. The data is currently password-protected on the group’s dark web leak site, with a six-day deadline for the airport to negotiate before public exposure. This breach poses severe risks of identity theft, travel fraud, and operational disruptions, given the granularity of the exposed records. The attack aligns with Everest’s recent focus on the aviation sector, following similar incidents like the Collins Aerospace breach, which caused widespread airport outages across Europe. The group’s extortion tactics—combining data theft with ransom demands—heighten the urgency for Dublin Airport to mitigate reputational, financial, and regulatory fallout.

Dublin Airport experienced significant operational disruption due to a Europe-wide cyber attack targeting check-in and boarding systems. As of midday on Sunday, 13 flights (9 inbound, 4 outbound) were cancelled, while airlines in Terminal 2 resorted to manual processes for bag tags and boarding passes, causing delays in check-in and bag drop. The incident forced passengers to allow extra time for procedures, with advisories to contact airlines directly for updates. While no data breach or ransomware was reported, the attack disrupted critical airport infrastructure, leading to financial losses for airlines, reputational damage for the airport, and passenger inconvenience (e.g., missed connections, stranded travelers). The incident also triggered a secondary security alert in Terminal 2 on Saturday, requiring evacuation and intervention by Gardaí and the Defence Forces’ EOD team, though this was later deemed unrelated to the cyber attack. The prolonged system outage highlights vulnerabilities in aviation cybersecurity, affecting thousands of travelers and airline operations across Europe.

A cyber attack disrupted critical check-in and boarding systems at Heathrow Airport, leading to operational chaos. Around 70 flights were cancelled on Saturday morning, while dozens more faced delays of up to three hours. The outage forced staff to revert to manual check-in and boarding procedures, significantly slowing down passenger processing. The incident also impacted Brussels and Berlin airports, suggesting the breach targeted a shared third-party service provider responsible for automated airport systems. Travel expert Simon Calder warned of potential 'widespread cancellations' due to the ongoing disruption. The attack caused financial losses (refunds, compensations, operational costs), reputational damage (passenger frustration, media coverage), and logistical strain (staff overtime, rescheduling). While no data breach was explicitly reported, the operational halt and cascading delays across multiple airports highlight severe vulnerabilities in aviation infrastructure. The incident underscores risks tied to supply chain cyber attacks, where a single compromised vendor can paralyze major hubs.

Brussels Airport experienced a cyberattack on Friday evening that crippled its passenger and baggage check-in systems, forcing manual processing and causing significant operational disruptions. The attack, which also affected other European airports, targeted a third-party service provider’s systems. As of Saturday, nine flights were cancelled, and 15 departed with delays, with no immediate resolution expected. Passengers were advised to confirm flight statuses before arriving, as the outage led to processing bottlenecks and potential further cancellations. An investigation is underway to assess the full extent of the damage, but the incident has already resulted in financial losses (e.g., compensation, operational costs), reputational harm due to publicized delays, and potential long-term trust erosion among travelers and partners. The attack disrupted critical infrastructure, highlighting vulnerabilities in supply chain cybersecurity and the cascading effects of third-party breaches on large-scale operations.

Ransomware Attack Disrupts Check-In Systems at Major European Airports A ransomware attack targeting Collins Aerospace, a key supplier of automated check-in systems, caused widespread disruptions at several of Europe’s busiest airports on February 10–12, 2026. The incident, confirmed by the EU’s cybersecurity agency (ENISA), locked critical data and forced airports to revert to manual processes, leading to flight cancellations and delays. Affected Airports and Impact - Brussels Airport reported 29 cancellations and only 42% of flights departing on time, with staff using iPads and laptops for manual check-ins. - London Heathrow, Europe’s busiest airport, implemented contingency measures as airlines struggled with system outages. - Berlin Airport, already strained by high passenger volumes due to the Berlin Marathon, faced delays exceeding one hour for departures. - Dublin Airport experienced minimal impact, relying on manual boarding procedures, including handwritten passes. Scope and Response Collins Aerospace, owned by RTX, stated it was working with affected airports to restore full functionality, with updates nearing completion. ENISA confirmed law enforcement involvement but did not disclose the attack’s origin. Sophos threat intelligence director Rafe Pilling noted that while high-profile ransomware attacks are more visible, they are not necessarily increasing in frequency though their disruptive potential remains a growing concern for critical infrastructure. Broader Context The incident underscores the vulnerability of aviation systems to cyber threats. A recent Bitkom survey found ransomware as the most common cyberattack against German companies, with one in seven paying ransoms. Despite the disruption, analysts emphasize that large-scale attacks with physical-world consequences remain rare.

A cyber-criminal group, specifically the Everest ransomware group, breached a third-party supplier (Collins Aerospace), compromising an IT server containing passenger boarding pass data from 1–31 August at Dublin Airport. The data was later exposed online by the group, though no ransom demand was publicly listed. The attack caused major disruptions, including flight delays and cancellations across European airports in September. While DAA confirmed no direct impact on its own systems, the incident remains under investigation with regulators (Irish Aviation Authority, Data Protection Commission, National Cyber Security Centre) and affected airlines. Passengers were advised to monitor for unusual booking activity, though no immediate action was required. The breach highlights vulnerabilities in third-party vendor security and the operational risks of ransomware attacks on critical travel infrastructure.

Collins Aerospace, a critical supplier in the aerospace and defense industry, fell victim to a ransomware attack that disrupted European airports by targeting its digital supply chain dependencies. The incident, highlighted in ENISA’s Threat Landscape 2025 report, exemplifies how cyber-attacks on high-value vendors can cascade into broader operational failures. While specific details on data compromise were not disclosed, the attack caused significant service outages, delaying flights and grounding operations across multiple airports reliant on Collins’ systems. The disruption underscored vulnerabilities in interconnected OT (operational technology) and supply chain networks, where a single breach can paralyze downstream services. ENISA warned that such attacks exploit critical dependency points, amplifying impact beyond the initial target. The incident aligns with a rising trend of threat actors leveraging ransomware to cripple essential infrastructure, with financial and reputational fallout extending to airlines, passengers, and regulatory bodies. No direct mention of data theft was made, but the operational halt suggests severe financial losses, reputational damage, and potential regulatory scrutiny for failing to secure supply chain resilience.