Loading story…
A ransomware attack targeting Collins Aerospace's passenger processing software caused widespread disruptions at major European airports, including London Heathrow, Berlin Brandenburg, and Brussels. The attack, which began on September 19, affected the ARINC SelfServ cMUSE and MUSE systems used for check-in and baggage handling, forcing airports to switch to manual processes and resulting in hundreds of flight cancellations and extensive delays. The UK's National Crime Agency arrested a man in West Sussex on suspicion of Computer Misuse Act offences in connection with the incident, though the investigation remains ongoing. RTX Corporation, the parent company of Collins Aerospace, confirmed the attack and stated that the affected systems operate on customer-specific networks outside the main RTX enterprise network. The incident highlights the significant operational impact ransomware can have on critical aviation infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
UK law enforcement arrested a man in connection with the cyberattack on Collins Aerospace software that disrupted airport operations. Multiple outlets reported the arrest as a key development in the investigation into the Heathrow-related incident.
The attack caused operational disruption at Heathrow Airport and elsewhere, leading to flight chaos and check-in problems as affected software became unavailable. News reports describe the incident as having a significant knock-on effect on airport operations.
A cyberattack targeted Collins Aerospace systems used for airline check-in and related airport operations, disrupting services relied on by multiple airports and carriers. The incident was later linked in reporting to RTX, Collins Aerospace's parent company.
5 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourceindependent.co.uk
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cyberattack targeting Collins Aerospace, a key provider of check-in and boarding systems, caused significant operational disruption at major European airports including Heathrow, Brussels, and Berlin. The attack rendered automated check-in and baggage drop systems inoperable, forcing airports to revert to manual processes, resulting in widespread delays and cancellations. No evidence of data theft or ransomware has been reported, but the incident highlights the critical risk posed by third-party vendor vulnerabilities in aviation infrastructure.
Jun 29, 2026
The Everest ransomware group claimed responsibility for a significant cyberattack on Dublin Airport, exfiltrating the personal data of over 1.5 million passengers. The stolen information includes full names, flight details, frequent flyer information, baggage tag numbers, and other sensitive travel data. The group listed Dublin Airport as a victim on its leak site, password-protecting the data and demanding negotiations within six days to prevent public release. Irish authorities and the National Cyber Security Centre have launched investigations, while Dublin Airport faces the challenge of rebuilding its affected servers from scratch. The attack highlights critical vulnerabilities in aviation infrastructure, particularly the reliance on centralized software platforms such as Collins Aerospace’s MUSE system. The incident has caused operational disruptions, forcing manual fallback procedures and resulting in significant delays and inconvenience for passengers. The Everest campaign underscores the urgent need for enhanced cybersecurity resilience across the aviation sector, as the breach not only threatens data privacy but also exposes the operational fragility of major airports.
Jun 29, 2026
McLaren Health Care confirmed it was hit by a ransomware attack that disrupted clinical and business operations across its Michigan network, forcing the organization to rely on downtime procedures and warning that recovery would extend into September. Follow-up reporting said McLaren was still restoring systems weeks later and had not yet determined whether patient or employee data had been accessed or stolen, leaving the scope of any data compromise unclear as the health system worked to bring affected services back online. Ascension, one of the largest U.S. health systems, also suffered a major cyberattack that caused widespread outages, diverted ambulances, and disrupted electronic health records, phone systems, and other care operations; reporting at the time linked the incident to suspected **Black Basta** ransomware activity. Later disclosures said the attack resulted in a data breach affecting **5.6 million people**, exposing personal, insurance, medical, and payment-related information and underscoring how ransomware incidents in healthcare can escalate from operational disruption to large-scale compromise of sensitive patient data.
Jul 12, 2026