Cyberattack Disrupts Major European Airports, Causing Widespread Flight Chaos Between 4 and 6 April, a sophisticated cyberattack targeted a shared IT platform used by airlines and airports across Europe, triggering cascading disruptions at key hubs. The incident paralyzed critical systems including check-in, baggage handling, and boarding at Heathrow, Charles de Gaulle, Frankfurt, and Copenhagen airports, forcing staff to revert to manual processes. The fallout was severe: over 1,600 flights were canceled or delayed on 6 April alone, with airlines activating emergency rosters and passengers advised to arrive early with printed itineraries. While Prague’s Václav Havel Airport was not directly affected, knock-on effects caused delays for several flights on Easter Monday and Tuesday as aircraft and crews were mispositioned. The attack exposed vulnerabilities in aviation’s digital infrastructure, prompting discussions on supply-chain resilience and duty-of-care obligations for businesses. Travel management firms in Prague have since updated contingency plans, recommending flexible bookings, digital visa backups, and buffer days for high-stakes travel. Cybersecurity analysts warn the incident may accelerate EU efforts to include aviation under the Critical Entities Resilience Directive, pushing airports to invest in network segmentation and offline backups. Prague Airport, which already has redundancy plans in its digital transformation strategy, is expected to prioritize these upgrades in response to the disruption.

2025: A Year of Rising Costs—and Escalating Cyber Threats for UK Businesses As 2025 draws to a close, UK businesses and charities have faced a surge in financial pressures—from soaring employment costs and supply chain disruptions to oil and tariff shocks. Yet, one of the most damaging expenses has been the fallout from cyberattacks, which have hit nearly half of British companies and 30% of charities over the past year. High-profile victims include retail giants Marks & Spencer, Adidas, and the Co-op Group, as well as Heathrow Airport, Harrods, and Jaguar Land Rover (JLR). The public sector hasn’t been spared either: Germany’s parliament and the UK Foreign Office (breached in October) were among those targeted. Attacks ranged from phishing scams to full-scale digital shutdowns, with some incidents costing hundreds of millions. The scale of cybercrime has reached staggering proportions. Cybersecurity Ventures estimates the global cost of cyberattacks in 2025 at $10.5 trillion (£7.8 trillion)—a figure that would rank cybercrime as the world’s third-largest economy, trailing only the US and China. The financial and operational toll underscores the growing threat to organizations across sectors.

The Everest ransomware gang claimed responsibility for a cyberattack on Collins Aerospace, a critical subsidiary of RTX (Raytheon Technologies), disrupting operations at major European airports, including Heathrow (London), Brussels, and Berlin. The attack targeted Muse software, crippling check-in and boarding systems, leading to flight delays, cancellations, and forced manual operations. Collins Aerospace is a key provider of avionics, mission systems, and defense technologies for commercial, military, and space applications, making it a high-value target in the global aerospace and defense supply chain. The breach raised concerns over potential access to classified or sensitive data, threatening national security, defense readiness, and critical infrastructure integrity. The Everest group’s leak site briefly vanished post-claim, fueling speculation of law enforcement intervention, panic, or strategic retreat due to the target’s sensitivity. The incident underscores the evolving ransomware threat, where attacks transcend financial extortion to geopolitical disruption, eroding trust in essential aviation and defense systems. The cascading impact on airport operations and military supply chains highlights vulnerabilities in interconnected critical infrastructure, demanding enhanced cross-sector cybersecurity collaboration to mitigate future risks.

Dublin Airport experienced significant operational disruption due to a Europe-wide cyber attack targeting check-in and boarding systems. As of midday on Sunday, 13 flights (9 inbound, 4 outbound) were cancelled, while airlines in Terminal 2 resorted to manual processes for bag tags and boarding passes, causing delays in check-in and bag drop. The incident forced passengers to allow extra time for procedures, with advisories to contact airlines directly for updates. While no data breach or ransomware was reported, the attack disrupted critical airport infrastructure, leading to financial losses for airlines, reputational damage for the airport, and passenger inconvenience (e.g., missed connections, stranded travelers). The incident also triggered a secondary security alert in Terminal 2 on Saturday, requiring evacuation and intervention by Gardaí and the Defence Forces’ EOD team, though this was later deemed unrelated to the cyber attack. The prolonged system outage highlights vulnerabilities in aviation cybersecurity, affecting thousands of travelers and airline operations across Europe.

A cyber attack on Collins Aerospace’s Muse software platform—used for flight check-ins, baggage handling, and boarding coordination—disrupted operations at major European airports, including Heathrow (UK), Berlin (Germany), and Brussels (Belgium). The attack forced airlines to manually process passengers, leading to flight cancellations, delays, and stranded travelers. While Collins confirmed the breach, no details were disclosed regarding the attacker’s identity, motive, or potential customer data compromise. The incident follows geopolitical tensions, with suspicions pointing toward state-backed Russian hackers targeting European infrastructure. Delhi and Bengaluru airports (India), which also use Muse, remained unaffected but are monitoring the situation. The attack highlights vulnerabilities in critical aviation software monopolies, where redundancies are limited, and disruptions cascade globally.

A cyber attack disrupted critical check-in and boarding systems at Heathrow Airport, leading to operational chaos. Around 70 flights were cancelled on Saturday morning, while dozens more faced delays of up to three hours. The outage forced staff to revert to manual check-in and boarding procedures, significantly slowing down passenger processing. The incident also impacted Brussels and Berlin airports, suggesting the breach targeted a shared third-party service provider responsible for automated airport systems. Travel expert Simon Calder warned of potential 'widespread cancellations' due to the ongoing disruption. The attack caused financial losses (refunds, compensations, operational costs), reputational damage (passenger frustration, media coverage), and logistical strain (staff overtime, rescheduling). While no data breach was explicitly reported, the operational halt and cascading delays across multiple airports highlight severe vulnerabilities in aviation infrastructure. The incident underscores risks tied to supply chain cyber attacks, where a single compromised vendor can paralyze major hubs.

European Airports Hit by Major Ransomware Attack, Stranding Thousands A weekend cyberattack disrupted check-in and boarding systems at multiple major European airports on September 20, 2025, causing widespread flight delays and cancellations. The incident, which affected Heathrow Airport Terminal 4 and other locations, left thousands of passengers stranded as airlines struggled with manual processing. The attack targeted Collins Aerospace, a subsidiary of RTX, though no ransomware group has yet claimed responsibility. Cybersecurity experts noted that while most ransomware operations focus on financial extortion, a growing subset of attackers particularly Western-based groups are pursuing high-profile targets for reputational clout within criminal networks. Rafe Pilling, Director of Threat Intelligence at Sophos, warned that these "outliers" are becoming more ambitious, prioritizing disruption over purely monetary gains. The European Union Agency for Cybersecurity (ENISA) confirmed the breach on September 22, highlighting the increasing boldness of cybercriminals. Martyn Thomas, Emeritus Professor of IT at Gresham College, cautioned that such attacks could escalate to critical infrastructure or healthcare systems, risking physical harm if motivations shift. The incident follows a pattern of rising high-impact ransomware attacks, including a 2024 breach of London’s Transport for London (TfL), which the UK National Crime Agency (NCA) attributed to the Scattered Spider group. That attack, linked to two teenagers, caused millions in losses and demonstrated the growing threat posed by organized cybercriminal networks. While the exact perpetrators of the airport hack remain unidentified, the event underscores the escalating risks of ransomware as attackers expand their targets and tactics.