Air travel across Europe faced unprecedented disruption over the weekend and into Monday after automated check-in systems at several major airports were crippled.
The EU agency confirms ransomware attack as the cause, raising alarms about the vulnerability of critical infrastructure to malicious cyber incidents.
According to the European Union Agency for Cybersecurity (ENISA), the ransomware infiltrated systems managed by Collins Aerospace, a unit of RTX, forcing airports in Brussels, Berlin, Dublin, and London Heathrow to adopt emergency manual check-in processes.
While passenger safety was not compromised, the incident triggered widespread flight cancellations, hours-long delays, and chaotic scenes at departure halls.
EU Agency Confirms Ransomware Attack on Airports
ENISA issued a statement on Monday confirming that the attack was a ransomware incident—malicious software designed to lock up data until a ransom is paid.
The EU agency confirms ransomware attack without disclosing the origin of the hackers, though it added that law enforcement agencies across Europe are already investigating the breach.
“Law enforcement is involved to investigate,” ENISA stated, underscoring the seriousness of the attack on vital aviation infrastructure.
The agency noted that while ransomware has become a common cyber threat to corporations, its direct impact on passenger services at airports highlights a dangerous escalation.
Cybersecurity analysts say the attack demonstrates how digital vulnerabilities can spill into the physical world, directly affecting thousands of people in real time.
Collins Aerospace confirmed on Monday that it was working closely with affected airports to restore automated systems.
The company reported it was in the final stages of updating software patches to return operations to normal.
Still, disruptions were visible across Europe.
Berlin Airport: Struggling with larger-than-usual passenger volumes due to the Berlin Marathon, it reported delays exceeding one hour as staff manually processed passengers.
Brussels Airport: Of roughly 550 flights scheduled for Monday, 60 had to be cancelled. Staff resorted to laptops and iPads to check in passengers.
Dublin Airport: The impact was described as “minimal,” though manual processes were in place after Terminal 2 had been temporarily evacuated on Saturday.
London Heathrow: Europe’s busiest hub also reported disruptions but noted progress in system restoration.
Passengers described the experience as reminiscent of early commercial aviation days, with handwritten boarding passes and longer wait times.
Rafe Pilling, Director of Threat Intelligence at UK cybersecurity firm Sophos, explained that ransomware attackers increasingly target high-profile victims such as airports because of the attention these attacks generate.
“The EU agency confirms ransomware attack has gained visibility, but it’s important to note that disruptive attacks are becoming more visible, not necessarily more frequent,” Pilling said.
“Truly large-scale events that affect physical operations remain rare but highly impactful.”
A recent survey by German industry group Bitkom found ransomware to be the most common form of cyberattack, with one in seven companies admitting to paying a ransom.
Analysts warn that as digital systems become more intertwined with daily operations, attacks on transport hubs and other critical infrastructure may become more common.
The attack has raised questions about the resilience of Europe’s aviation sector against growing cyber threats.
With check-in systems forming the backbone of airport operations, the disruption revealed how a single ransomware breach could paralyze services across multiple countries.
Cybersecurity experts argue that investments in stronger firewalls, encrypted backups, and real-time monitoring are essential.
“This incident shows that ransomware is no longer just an IT problem—it’s a national security issue,” said one analyst.
Governments across Europe are expected to review aviation cybersecurity standards in the wake of the incident.
Officials have hinted that stricter regulations for service providers such as Collins Aerospace may be introduced to ensure redundancy and data protection.
While Collins Aerospace says it is close to restoring full functionality, the EU agency confirms ransomware attack has already sparked debate about preparedness.
Travelers affected by the incident voiced frustration at the lack of timely communication, while airlines faced additional costs from flight cancellations and delays.
The incident comes at a time when ransomware has already targeted other industries.
Earlier this year, Jaguar Land Rover was forced to pause production due to a cyberattack, while healthcare systems in parts of Europe have also faced disruptions.
For passengers, the event served as a stark reminder that cybersecurity is no longer confined to the digital world—it can ground planes, disrupt journeys, and affect livelihoods. For policymakers, it was a wake-up call to treat aviation cybersecurity with the same
About The Author
