European Airports Still Grappling with Aftermath of Cyberattack
Several European airports are still experiencing disruptions following a recent ransomware attack. The incident which occurred several days ago continues to impact flight schedules and airport operations causing headaches for travelers.
Impact on Airport Operations
The ransomware attack has affected key systems leading to:
- Flight delays and cancellations
- Disruptions in baggage handling
- Check-in process slowdowns
Airlines and airport authorities are working to restore systems and minimize further disruptions. Passengers are advised to check their flight status and arrive at the airport well in advance.
Cybersecurity Measures
This recent airport cyberattack underscores exactly how fragile critical infrastructure can be and reinforces the need for proactive multilayered defenses. Below is more information on the incident the risks it highlights and best practices for strengthening cybersecurity in such contexts.
Recent Incident European Airport Disruption
In September 2025 major European airports Heathrow Berlin Brussels among others experienced disruptions to check-in boarding and baggage systems. The issue was traced to a cyberattack on Collins Aerospace’s MUSE vMUSE system which many carriers use for shared check-in boarding infrastructure.
The EU cybersecurity agency ENISA confirmed the attack was a ransomware incident.
Because many airports use the same vendor system attacking a central provider allowed wide downstream impact i.e. a supply chain attack.
Some airports reverted to manual operations as a fallback but service quality and throughput were heavily degraded.
Experts note that reactive defenses are no longer sufficient. Systems must be resilient continuously monitored and designed with failure modes in mind.
Why Airports Are Attractive Targets
- High impact & visibility: Disrupting airport systems causes enormous operational chaos financial losses and media attention.
- Tightly integrated systems: Airports have many connected systems check-in baggage flight ops radar passenger services. A breach in one can cascade.
- Legacy aging infrastructure: Many systems weren’t built with modern cybersecurity threats in mind they might rely on outdated protocols or weak segmentation.
- Vendor supply chain exposure: As seen in this case a compromise at a third-party vendor can cascade to multiple airports.
- Regulatory & legal consequences: When critical services are impacted regulatory bodies may impose fines oversight, or mandate cybersecurity standards.
Ransomware Attacks on the Rise
- In 2025 nearly 63% of businesses worldwide reported being affected by ransomware. Statista
- Government entities have seen a 65% increase in ransomware attacks in the first half of 2025 compared to the same period in 2024.
- Total logged ransomware attacks in H1 2025 were 3,627 globally up about 47% over H1 2024.
Key Impacts & Costs
- Ransom demands: For government agencies in H1 2025 the average ransom requested was about US$1.65 million across both confirmed and unconfirmed attacks. In confirmed attacks average demands rose to nearly US$2.44 million.
- Downtime: Manufacturing firms are reporting average downtime of 11.6 days per ransomware incident with losses of ~US$1.9 million per day from downtime in some cases.
- Total economic impact:
• In Germany cyber-attacks ransomware being the most damaging cost the economy about €300 billion ~US$355 billion) over a recent period.
• In one case Jaguar Land Rover expects losses of £3.5 billion revenue and £1.3 billion gross profits if its disrupted operations don’t resume quickly after its cyberattack.
Other Costs Beyond the Ransom
- Recovery costs: Hiring cybersecurity experts forensic investigations restoring systems and data from backups.
- Operational disruption: Lost productivity halting or slowing of services possibly shutting down entire facilities or supply chains.
- Reputational damage: Loss of customer trust customer compensation regulatory scrutiny.
- Regulatory fines & legal exposure: If data breaches occur or privacy laws are violated.
Recent High-Profile Examples
Jaguar Land Rover: A cyberattack has led to a factory shutdown major supply chain disruption with enormous cost implications.
Collins Aerospace RTX: Ransomware attack disrupted airport check-in and baggage drop systems across Europe.
