Quick answer: On 19 and 20 September 2025, a cyberattack on Collins Aerospace’s MUSE passenger processing software disrupted electronic check-in and baggage drop at several European airports, including London Heathrow, Brussels and Berlin. Airlines switched to manual check-in, causing delays and cancellations. Reports cited ENISA, the EU’s cybersecurity agency, as describing it as ransomware.
| Key facts | |
|---|---|
| Date | 19 to 20 September 2025, with disruption for several days |
| Organization | Collins Aerospace (part of RTX), supplier of MUSE check-in software |
| Type of attack | Attack on a shared supplier, reported as ransomware |
| Attacker | Not publicly named |
| Impact | Electronic check-in and baggage drop disrupted at Heathrow, Brussels, Berlin and others; delays and cancellations |
| Response | Manual check-in; a suspect arrested in West Sussex by the UK National Crime Agency, later released on bail |
Timeline
- 19 September 2025: Collins Aerospace’s MUSE system is disrupted at several European airports.
- 20 September 2025: RTX confirms a “cyber-related disruption” limited to electronic check-in and baggage drop.
- Following days: Brussels and other airports cancel flights while systems are restored; reports cite ENISA describing ransomware.
- Later: The UK National Crime Agency arrests a suspect in West Sussex, who is released on conditional bail.
What happened
Many airports do not run their own check-in systems. Airlines share common platforms provided by specialist suppliers. MUSE, made by Collins Aerospace, is one of them. When it was disrupted by a cyberattack, every airline using it at the affected airports lost electronic check-in and bag drop at the same time.
RTX, Collins Aerospace’s parent company, said it was aware of a “cyber-related disruption” to MUSE at select airports and that the impact could be mitigated with manual check-in. Staff at Heathrow, Brussels and Berlin handled passengers by hand, causing long queues, delays and cancellations.
Was it ransomware?
Media reports cited ENISA as confirming the disruption was caused by ransomware, although some analysts noted that no group claimed responsibility and no data theft was publicly reported. Either way, the incident shows how one supplier can become a single point of failure for a whole sector.
Lessons for your organization
- Identify shared platforms your business depends on and what happens if they fail.
- Keep manual fallback procedures documented, practised and staffed.
- Ask critical suppliers about their incident response and recovery times.
- Include supplier outages in business continuity exercises.
- Communicate early and clearly with customers during disruption.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. Read more about supply chain threats. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Frequently asked questions
Which airports were hit by the Collins Aerospace cyber attack?
London Heathrow, Brussels and Berlin were the most affected, with minor impacts at Dublin and Cork.
What is MUSE?
MUSE is Collins Aerospace’s shared passenger processing system that airlines use for check-in and baggage drop at many airports.
Was anyone arrested?
Reports said the UK National Crime Agency arrested a suspect in West Sussex, who was later released on conditional bail.
