‘Collins Aerospace attack was ransomware’

Juhan Lepassaar Director of ENISA EU cyber security agency.png

The European Union Agency for Cybersecurity has confirmed that a ransomware attack targeted Collins Aerospace and caused disruptions at multiple airports across the continent.

The incident affected automated check-in and boarding systems provided by the US-based company, a subsidiary of RTX, and began on Friday evening.

Airports including Brussels, Berlin Brandenburg and London Heathrow resorted to manual processes for passenger handling, which led to queues exceeding one hour and dozens of flight cancellations.

ENISA revealed the type of ransomware involved but withheld further details, stating law enforcement agencies have joined the investigation into the malicious software that encrypts data until a ransom demand is met.

Collins Aerospace reported progress in software updates as of Monday afternoon, with full restoration expected within hours at most sites, though Brussels Airport noted uncertainty over system security.

Previous attack

The attack followed a pattern of ransomware incidents against high-profile targets. A German industry survey from Bitkom that found one in seven companies paid a ransom after similar breaches.

RTX described the impact as confined to electronic check-in and baggage drop functions, with manual alternatives in place to mitigate effects on departures. Dublin Airport reported limited disruption by Monday, having implemented paper-based boarding passes early in the response. ENISA’s statement underscored involvement of national authorities without specifying the attack’s origin or any ransom payment status.

Cybersecurity experts from Sophos observed that such visible disruptions in Europe have increased, yet large-scale incidents impacting physical operations like aviation remain infrequent. Collins Aerospace had faced a prior ransomware claim in 2023 according to breach-tracking sites, though no connection to the current event was established. Airport operators in affected locations urged passengers to arrive earlier and use self-service kiosks where available, as recovery efforts continued into Tuesday.

No data breaches beyond system access were reported by the company, which prioritised isolation of infected networks to prevent spread.