A cyber-attack disrupted Collins Aerospace’s Muse software, which manages electronic check-in and baggage systems for multiple airlines across European airports, including Heathrow, Brussels, and Berlin. The outage forced manual check-ins, causing multi-hour delays, missed connections, and operational chaos. While British Airways used a backup system, most airlines at Heathrow were severely affected, with passengers stranded in long queues, luggage tagging done manually, and boarding passes failing at gates. Brussels Airport faced flight cancellations and schedule reductions (50% capacity), while Dublin and Cork experienced minor delays. The incident disrupted thousands of travelers, including elderly and mobility-impaired passengers who missed critical flights (e.g., funerals, medical connections). Though no data breach or ransomware was reported, the attack exposed vulnerabilities in shared aviation infrastructure, echoing prior global IT failures (e.g., CrowdStrike 2024). Authorities, including the UK’s National Cyber Security Centre and the European Commission, intervened to mitigate fallout, but recovery extended into Sunday. The financial and reputational damage included operational costs, passenger compensation, and erosion of trust in digital airport systems.
Source: https://www.bbc.com/news/articles/c3drpgv33pxo
TPRM report: https://www.rankiteo.com/company/collins-aerospace
"id": "col2394223100325",
"linkid": "collins-aerospace",
"type": "Cyber Attack",
"date": "6/2024",
"severity": "60",
"impact": "2",
"explanation": "Attack limited on finance or reputation"{'affected_entities': [{'customers_affected': 'Thousands (long queues, delayed '
'flights)',
'industry': 'Aviation',
'location': 'London, UK',
'name': 'Heathrow Airport',
'type': 'Airport'},
{'customers_affected': 'Large-scale delays, 50% flight '
'cancellations',
'industry': 'Aviation',
'location': 'Brussels, Belgium',
'name': 'Brussels Airport',
'type': 'Airport'},
{'customers_affected': 'Longer waiting times',
'industry': 'Aviation',
'location': 'Berlin, Germany',
'name': 'Berlin Brandenburg Airport',
'type': 'Airport'},
{'customers_affected': 'Minor impact (manual check-ins)',
'industry': 'Aviation',
'location': 'Dublin, Ireland',
'name': 'Dublin Airport',
'type': 'Airport'},
{'customers_affected': 'Minor impact',
'industry': 'Aviation',
'location': 'Cork, Ireland',
'name': 'Cork Airport',
'type': 'Airport'},
{'customers_affected': 'Multiple airlines using Muse '
'software',
'industry': 'Aerospace/Defense',
'location': 'Global (HQ: USA)',
'name': 'Collins Aerospace (RTX)',
'type': 'Software Provider'},
{'customers_affected': 'Passengers at Heathrow (2+ hour '
'queues)',
'industry': 'Aviation',
'location': 'Global (HQ: Malaysia)',
'name': 'Malaysia Airlines',
'type': 'Airline'},
{'customers_affected': 'Minimal (backup systems used)',
'industry': 'Aviation',
'location': 'UK',
'name': 'British Airways',
'type': 'Airline'}],
'customer_advisories': ['Heathrow: Arrive no earlier than 3 hours (long-haul) '
'or 2 hours (domestic) before flights.',
'Brussels Airport: Expect large-scale delays and '
'cancellations.',
'Dublin Airport: Terminal 2 reopened after unrelated '
'security alert.'],
'date_detected': '2025-09-20T00:00:00Z',
'date_publicly_disclosed': '2025-09-21T00:00:00Z',
'description': 'A cyber-attack targeted the Muse software by Collins '
'Aerospace (owned by RTX), disrupting electronic check-in and '
'baggage systems at several European airports, including '
'Heathrow, Brussels, and Berlin Brandenburg. The attack caused '
'significant delays, manual check-in processes, and '
'operational disruptions. Airlines like British Airways used '
'backup systems, while others faced severe delays. The '
'incident highlighted vulnerabilities in interconnected '
'aviation digital systems, reminiscent of the July 2024 '
'CrowdStrike IT crash.',
'impact': {'brand_reputation_impact': ['Negative passenger experiences',
'Media coverage of chaos at major '
'airports'],
'customer_complaints': ['Reports of multi-hour delays',
'Lack of mobility assistance',
'Missed flights',
'Hunger/tiredness due to prolonged waits'],
'downtime': ['2025-09-20 (late night) to at least 2025-09-21 '
'(ongoing recovery)'],
'operational_impact': ['Flight delays',
'Manual check-in processes',
'Long passenger queues',
'Missed connections',
'Terminal evacuations (Dublin T2, unrelated '
'security alert)',
'Flight cancellations (Brussels Airport: '
'50% schedule reduction)'],
'systems_affected': ['Muse software (electronic check-in and '
'baggage drop)',
'Airline departure control systems']},
'investigation_status': 'Ongoing (National Cyber Security Centre, RTX/Collins '
'Aerospace, and European authorities involved)',
'lessons_learned': ['Interconnected aviation systems are highly vulnerable to '
'cyber disruptions.',
'Backup systems and manual processes are critical for '
'resilience.',
'Proactive communication and staff deployment can '
'mitigate passenger frustration.',
'Similar to the 2024 CrowdStrike incident, digital '
'dependencies in aviation pose systemic risks.'],
'recommendations': ['Enhance cybersecurity for third-party aviation software '
'providers.',
'Implement redundant systems for check-in and baggage '
'operations.',
'Improve cross-border coordination for cyber incident '
'response in aviation.',
'Conduct regular drills for manual operations during '
'outages.'],
'references': [{'date_accessed': '2025-09-21',
'source': 'BBC News',
'url': 'https://www.bbc.com/news/uk-66881234'},
{'date_accessed': '2025-09-21',
'source': 'Reuters',
'url': 'https://www.reuters.com/world/uk/heathrow-airport-hit-by-cyber-attack-causing-delays-2025-09-21/'},
{'date_accessed': '2025-09-21',
'source': 'FlightAware',
'url': 'https://www.flightaware.com'}],
'regulatory_compliance': {'regulatory_notifications': ['European Commission '
'monitoring',
'National Cyber '
'Security Centre (UK) '
'involved']},
'response': {'communication_strategy': ['Public apologies from Heathrow',
'Regular updates from Transport '
'Secretary Heidi Alexander',
'Media statements from RTX/Collins '
'Aerospace'],
'containment_measures': ['Manual check-in processes',
'Backup systems (e.g., British '
'Airways)'],
'incident_response_plan_activated': True,
'law_enforcement_notified': True,
'recovery_measures': ['Passenger advisories to check flight '
'status',
'Prioritizing flight calls to reduce queue '
'times'],
'remediation_measures': ['RTX/Collins Aerospace working to '
'restore Muse software',
'Additional staff deployed at check-in '
'areas'],
'third_party_assistance': ['National Cyber Security Centre (UK)',
'European Commission',
'Eurocontrol']},
'stakeholder_advisories': ['Passengers advised to check flight status before '
'arriving at airports.',
'Airlines instructed to reduce flight schedules '
'(e.g., Brussels Airport cancellations).'],
'title': 'Cyber-Attack Disrupts Electronic Check-In and Baggage Systems at '
'Multiple European Airports',
'type': ['Cyber-Attack', 'Service Disruption', 'Operational Outage']}