Loading story…
A cyberattack targeting Collins Aerospace, a key provider of check-in and boarding systems, caused significant operational disruption at major European airports including Heathrow, Brussels, and Berlin. The attack rendered automated check-in and baggage drop systems inoperable, forcing airports to revert to manual processes, resulting in widespread delays and cancellations. No evidence of data theft or ransomware has been reported, but the incident highlights the critical risk posed by third-party vendor vulnerabilities in aviation infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting said ENISA identified the attackers' initial access path as coming through one of Collins Aerospace's third-party providers. This introduced a new supply-chain dimension to the ransomware incident affecting the ARINC vMUSE platform.
UK authorities announced the arrest of a man in connection with the cyberattack that disrupted European airports. The arrest marked the first known law enforcement action publicly tied to the incident.
Reporting indicated Collins Aerospace was deploying a software update to recover the Muse system and restore airport operations. Despite progress, some delays were still lingering into Monday.
The EU cybersecurity agency ENISA said the Collins Aerospace incident behind the airport disruptions was a ransomware attack. This clarified the nature of the attack after initial reporting had described it more generally as a cyberattack.
By Sunday, some affected airports reported easing conditions, though operational delays and restoration work continued. Collins Aerospace, ENISA, and the UK National Cyber Security Centre were involved in recovery coordination.
RTX, the parent company of Collins Aerospace, acknowledged a 'cyber-related disruption' impacting the Muse platform at select airports. The statement confirmed the vendor-side incident behind the airport operational problems.
On Saturday, major European airports including Heathrow, Brussels, Berlin, Dublin, and Cork reported delays, cancellations, and check-in disruption linked to the Collins Aerospace incident. Airports and airlines switched to manual processes while recovery efforts began.
A cyber incident struck Collins Aerospace's Muse airport software late Friday, disrupting the platform used for check-in and related airport operations. The attack affected select airports relying on the system.
29 references tracked. Mallory keeps watching after this page renders.
upguard.com
Open sourcebbc.co.uk
Open sourcetherecord.media
Open sourcehackread.com
Open sourcegovinfosecurity.com
Open sourcehackread.com
Open sourcebankinfosecurity.com
Open sourceblog.sucuri.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A ransomware attack targeting Collins Aerospace's passenger processing software caused widespread disruptions at major European airports, including London Heathrow, Berlin Brandenburg, and Brussels. The attack, which began on September 19, affected the ARINC SelfServ cMUSE and MUSE systems used for check-in and baggage handling, forcing airports to switch to manual processes and resulting in hundreds of flight cancellations and extensive delays. The UK's National Crime Agency arrested a man in West Sussex on suspicion of Computer Misuse Act offences in connection with the incident, though the investigation remains ongoing. RTX Corporation, the parent company of Collins Aerospace, confirmed the attack and stated that the affected systems operate on customer-specific networks outside the main RTX enterprise network. The incident highlights the significant operational impact ransomware can have on critical aviation infrastructure.
Jun 29, 2026
The Everest ransomware group claimed responsibility for a significant cyberattack on Dublin Airport, exfiltrating the personal data of over 1.5 million passengers. The stolen information includes full names, flight details, frequent flyer information, baggage tag numbers, and other sensitive travel data. The group listed Dublin Airport as a victim on its leak site, password-protecting the data and demanding negotiations within six days to prevent public release. Irish authorities and the National Cyber Security Centre have launched investigations, while Dublin Airport faces the challenge of rebuilding its affected servers from scratch. The attack highlights critical vulnerabilities in aviation infrastructure, particularly the reliance on centralized software platforms such as Collins Aerospace’s MUSE system. The incident has caused operational disruptions, forcing manual fallback procedures and resulting in significant delays and inconvenience for passengers. The Everest campaign underscores the urgent need for enhanced cybersecurity resilience across the aviation sector, as the breach not only threatens data privacy but also exposes the operational fragility of major airports.
Jun 29, 2026
A cybersecurity incident has disrupted the shared IT systems of the Royal Borough of Kensington and Chelsea, Westminster City Council, and the London Borough of Hammersmith and Fulham. The attack, first identified on a Monday morning, has led to outages affecting council websites, phone lines, and online reporting services, forcing the councils to invoke business continuity and emergency plans. The National Cyber Security Centre (NCSC) is assisting with remediation, and IT teams have implemented mitigations to restore services and protect data, though the full extent of the compromise remains under investigation. Authorities have stated that it is too early to determine the responsible party or the motive behind the attack, and investigations are ongoing to assess whether any data has been compromised. The councils have notified the Information Commissioner’s Office as a precaution and are prioritizing support for their most vulnerable residents. Residents have been advised of service disruptions and assured that updates will be provided as more information becomes available. Media reports suggesting Hackney Council was affected have been denied by officials.
Jun 29, 2026