Finance

EU agency confirms ransomware attack behind airport disruptions

Published by Global Banking & Finance Review

Posted on September 22, 2025

3 min read

· Last updated: January 21, 2026

Add as preferred source on Google
EU agency confirms ransomware attack behind airport disruptions
Global Banking & Finance Awards 2026 — Call for Entries

BERLIN (Reuters) -The European Union's cybersecurity agency said on Monday that airport disruptions caused by problems with automatic check-in systems were caused by a third-party ransomware incident.

EU Cybersecurity Agency Confirms Ransomware Caused Airport Disruptions

BERLIN (Reuters) -Airport disruptions that affected automated check-in systems in recent days were caused by a ransomware attack, the EU's cybersecurity agency said on Monday, highlighting the growing risks of such attacks to critical infrastructure and industries.

Several of Europe's biggest airports still faced disruptions on Monday after hackers knocked out automated check-in systems provided by Collins Aerospace, owned by RTX, affecting dozens of flights and thousands of passengers since Friday.

"Law enforcement is involved to investigate" malicious software that locks up data until the victim pays to have access restored, the ENISA agency said in a statement, without saying where the ransomware attack originated from.

Governments and companies have been the targets of cyberattacks in recent months, including luxury carmaker Jaguar Land Rover, which had to pause production as a result.

ATTACKS TEND TO TARGET HIGHER-PROFILE VICTIMS

Rafe Pilling, director of threat intelligence at British cybersecurity firm Sophos, said there have been more ransomware attempts targeting higher-profile victims because of the attention they bring, but such attacks weren't becoming more frequent.

"Disruptive attacks are becoming more visible in Europe, but visibility doesn't necessarily equal frequency," he told Reuters.

"Truly large-scale, disruptive attacks that spill into the physical world remain the exception rather than the rule."

A survey of some 1,000 companies by German industry group Bitkom found that ransomware - malicious software that locks up data until the victim pays to have access restored - was the most common form of cyberattack, with one in seven companies having paid a ransom.

MANY AIRPORTS YET TO RESTORE CHECK-IN SYSTEMS

Collins Aerospace said on Monday that it was working with the affected airports, including Brussels and London Heathrow, Europe's busiest airport, and was in the final stages of completing updates to help restore full functionality.

Berlin airport, which was facing higher passenger numbers than usual on Monday due to the Berlin Marathon, still did not have its check-in systems restored and reported delays of over an hour for departures.

One passenger described the boarding process as akin to the early decades of commercial air travel, with handwritten boarding passes.

Brussels Airport was using iPads and laptops to check passengers in online. Of roughly 550 departing and arriving flights, 60 had to be cancelled on Monday, it said.

Dublin Airport was experiencing "minimal impact" and had some manual processes in place.

(Reporting by Chrisoph Steitz in Frankfurt, James Pearson in London, Klaus Lauer and Sabine Siebold in Berlin, Bart Meijer in Brussels, Conor Humphries in Dublin, Writing by Miranda Murray, Editing by Rachel More and Bernadette Baum)

Key Takeaways

  • Ransomware attack caused airport disruptions in Europe.
  • Collins Aerospace's check-in systems were targeted.
  • Law enforcement is investigating the attack.
  • Ransomware is the most common form of cyberattack.
  • Airports like Brussels and Heathrow were affected.

Frequently Asked Questions

What caused the recent airport disruptions in Europe?
The recent airport disruptions were caused by a ransomware attack, as confirmed by the EU's cybersecurity agency.
Which airports were affected by the ransomware attack?
Airports including Brussels and London Heathrow were affected, with many flights experiencing delays and cancellations.
What measures are being taken in response to the attack?
Law enforcement is involved to investigate the malicious software, and Collins Aerospace is working with affected airports to restore systems.
How did passengers cope with the disruptions?
Passengers at some airports had to use manual processes, such as handwritten boarding passes, to check in due to the system failures.
What is the trend in ransomware attacks according to experts?
Experts indicate that ransomware attacks are increasingly targeting higher-profile victims, making these disruptive incidents more visible.

Tags

Related Articles

More from Finance

Explore more articles in the Finance category