In September 2025 ransomware took down a check-in platform airlines share across Europe. Within hours airlines at Heathrow, Brussels and Berlin moved to backup and manual check-in. Flights were delayed and cancelled, not stopped.
Most entries in this book are about a system that should not have been reachable. This one is about what happened after one was. At a common-use airport, airlines share check-in counters, gates and bag drops, run by a vendor’s software. That is sensible, and it means one vendor’s bad night is every airline’s at once. Nothing on the record reached aircraft, air traffic control or any operational technology.
The record shows a fallback that worked. The vendor said on day one that manual check-in could mitigate the impact. Brussels checked passengers in on laptops and iPads; Heathrow said the vast majority of its flights were operating as normal. Degraded, not stopped. The operators acted well. The open question is how one incident reached several airports’ own networks, which has never been disclosed. That the fallback, not any security control, kept flights moving is BlastWave’s reading of the record, not a disclosed finding.
What is not known: How the ransomware reached systems RTX says sit on customer-specific networks, and how the attacker got in, are undisclosed. ENISA said the ransomware type had been identified but did not name it. HardBit comes from researchers’ social posts with no source; Everest later claimed a data theft on its leak site; the claims are unreconciled. A man arrested in West Sussex was released on conditional bail with no charge publicly recorded. How many airports run the platform, and any cost, are undisclosed.
Recommendation
Take the path away from the vendor A shared platform should reach each operator only through a path that operator controls and can close, so one vendor compromise does not arrive at every airport at once.
Remove standing vendor access Support comes in by session, on request, bound to a named person, and leaves. No always-on tunnel into the systems that gate your operation.
Keep the manual path real Blank stock in the drawer, a procedure used this year, and systems that only need platform data reading it one way, so the fallback does not depend on what failed.
Sources: RTX Form 8-K, Item 8.01, filed 24 Sep 2025; Collins Aerospace statement, 20 Sep 2025; Brussels and Heathrow statements, 20 to 24 Sep 2025; ENISA, 22 Sep 2025; NCA, 24 Sep 2025; No government advisory. Full list with links.
Soft Spots: HardBit rests on researchers’ unsourced posts; Everest’s is a leak-site claim; neither is confirmed. That the manual fallback, not a security control, kept flights moving is BlastWave’s analysis. Airport statements are second hand.
The full record
Every claim numbered to its source. Last updated .
Ransomware took down a check-in platform that airlines share, and airlines at Heathrow, Brussels and Berlin moved to backup and manual check-in within hours. What is verified, what is only reported or claimed, and what is still unknown.
Summary
On 19 September 2025, RTX became aware of ransomware on systems supporting MUSE, Collins Aerospace's shared airport check-in software. Airlines at Heathrow, Brussels and Berlin moved to backup and manual check-in, and Dublin was also disrupted; flights were delayed and cancelled but not stopped. As of late September 2026, no company or government has named the ransomware family or the attacker.1,3,5
Timeline of the Collins Aerospace incident
Every date is tied to a source. Press reporting appears only as evidence of what was said.
RTX, Collins Aerospace's parent company, becomes aware of ransomware on systems that support its MUSE passenger processing software. Brussels Airport later says the attack took place that night.1,2
Collins reports a cyber-related disruption to its MUSE software in select airports and says the impact can be mitigated with manual check-in. Airlines at Heathrow, Brussels and Berlin move to backup and manual check-in; Berlin Brandenburg warns of longer waiting times. Brussels reports 10 cancellations and an average departure delay of about one hour in its first report; 25 departures are cancelled that day. daa reports minor impact at Dublin and Cork.2,3,4
Brussels Airport asks airlines to cancel about half of Monday's departures; 45 departures are cancelled on Sunday. Euronews reports staff handwriting boarding passes or using backup laptops.4,12
Brussels says check-in is now mainly done with laptops and iPads and that Collins is not yet able to deliver a new secure version. Heathrow says the vast majority of its flights are operating as normal. ENISA says the type of ransomware has been identified and does not name it.5,8
The National Crime Agency arrests a man in his forties in West Sussex on suspicion of Computer Misuse Act offences. He is released on conditional bail; the NCA announces the arrest the next day.6
RTX files a Form 8-K under Item 8.01 (Other Events), stating the incident has not had a material impact. Brussels Airport brings forward a replacement check-in system planned for November, about 500 workstations from 29 September.1,11
Researchers' social media posts naming HardBit ransomware are reported in the security press. The first was posted without a source; the second credits the first.9,10
Cybernews reports that the Everest group claimed a data theft from Collins on its leak site, with further posts reported on 12 November 2025.7
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Was it ransomware?
Yes. RTX's SEC filing and ENISA both say ransomware1,8
Verified
Which ransomware family?
Not named by RTX, Collins or any government. HardBit is researchers' unsourced assertion8,9,10
Undisclosed
Which systems were hit?
Systems supporting MUSE, on customer-specific networks outside RTX's enterprise network, per RTX1
Verified
How many airports were disrupted?
Four documented (Heathrow, Brussels, Berlin Brandenburg, Dublin), plus minor impact at Cork2,3,4,5
Verified (as reported)
Did flights stop?
No. Customers shifted to back-up or manual processes, with delays and cancellations1
Verified
Did the vendor name a fallback?
Yes, on 20 September: impact "can be mitigated with manual check-in operations"3
Verified (company statement, as carried)
Were boarding passes written by hand?
Reported by Euronews as a method staff used; not in any airport's own words we retrieved12
Reported only
Who carried it out?
Undisclosed. No government has attributed the incident
Undisclosed
Did Everest do it?
A leak-site claim of data theft, October 2025; unconfirmed and unreconciled with HardBit7
Claimed only
Was anyone charged?
A man was arrested on 23 September 2025 and released on conditional bail; no charge publicly recorded as of late September 20266
Ransomware hit systems that support MUSE, the Collins Aerospace software that lets several airlines share check-in desks, gates and baggage resources at an airport. RTX, Collins's parent company, says it became aware of the ransomware on 19 September 2025, and that the MUSE airport systems sit outside the RTX enterprise network, on customer-specific networks.1 Its filing describes what that meant for the airlines:
"Our customers have shifted to back-up or manual processes and have experienced certain flight delays and cancellations."
The filing names MUSE. Press coverage used both vMUSE and cMUSE; which variant ran at which airport is not in the record. How one incident reached systems on several airports' own networks has never been disclosed.
Did the airports stop operating?
No. Operations degraded to manual and backup processes; flights were delayed and cancelled, not stopped. On the first day, Collins said the disruption affected its MUSE software in select airports and that the impact was:
"limited to electronic customer check-in and baggage drop and can be mitigated with manual check-in operations"
Brussels reported 10 cancellations and an average departure delay of about one hour in its first report on Saturday 20 September. Euronews reported 25 departures cancelled that day and 45 on Sunday, and the airport asked airlines to cancel about half of Monday's departures.3,4 By Monday 22 September, Brussels said online check-in and self bag drop were still available and check-in was now mainly done with laptops and iPads, and that Collins was not yet able to deliver a new secure version.5 On 24 September it brought forward a replacement system planned for November, about 500 workstations from 29 September.11
"The vast majority of flights at Heathrow are operating as normal"
Berlin Brandenburg warned of longer waiting times because of an outage at a service provider, and daa reported minor impact at Dublin and Cork.2,3Euronews reported staff handwriting boarding passes or using backup laptops; that is a reported method, not an airport's own words in any statement we retrieved.12
Who was behind the Collins Aerospace attack?
No company or government has named the attacker or the ransomware family, as of late September 2026. The EU cyber agency said on 22 September 2025:
"The type of ransomware has been identified. Law enforcement is involved to investigate."
It did not name the type, and no filing names it. The HardBit name comes from researchers' social media posts: Kevin Beaumont's Mastodon post, made without a source, and Dominic Alvieri's X post, which credits Beaumont.9,10 Separately, in October 2025, the Everest group claimed a data theft from Collins on its leak site.7 Researchers asserted one; a leak-site group claimed the other. The two have never been reconciled, and neither has been confirmed by Collins, RTX or any government.
On 24 September 2025 the National Crime Agency announced that a man in his forties had been arrested in West Sussex the previous evening on suspicion of Computer Misuse Act offences and released on conditional bail. The NCA said the investigation was in its early stages.6 An arrest is not a charge. No charge is publicly recorded as of late September 2026, and the NCA has not linked the arrest to either ransomware claim.
Did the attack reach aircraft, air traffic control or operational technology?
Nothing on the record touched aircraft, flight operations systems or air traffic control. Passenger processing is business IT at an airport. RTX's filing describes systems that support check-in, gate and baggage resources, and the disruption it reports is customers moving to back-up or manual processes, with delays and cancellations.1 No statement from RTX, Collins, the airports, ENISA or the NCA says otherwise.
In BlastWave's reading, this is an IT compromise that degraded physical operations without halting them: one step below the incidents where an IT compromise halts physical operations outright. It is in Hackopedia for what it shows about fallback on a shared platform, which is BlastWave's analysis rather than a disclosed finding.
How many airports were affected by the Collins Aerospace incident?
Four airports are documented as disrupted: London Heathrow, Brussels, Berlin Brandenburg and Dublin, with minor impact also reported at Cork.2,3,4,5 The figure of 170 or more airports that circulated after the incident cannot be traced to any document. At best it describes how many airports run the software, an installed base, not the number disrupted. How many airports run the platform is itself undisclosed.
What is still not known about Collins Aerospace
How the ransomware reached systems that RTX says sit on customer-specific networks, at several airports at once.1
How the attacker first got in. No vector has been published by RTX, Collins or any agency.
Which ransomware was used. ENISA said only that the type had been identified.8
Whether the researchers' HardBit assertion and Everest's leak-site claim describe the same incident or actor. They have never been reconciled.7,9,10
Whether any charge will follow the September 2025 arrest. None is publicly recorded as of late September 2026.6
How many airports run the MUSE platform, and which MUSE variant ran where.
Any cost. RTX says the incident has not had a material impact.1
Claims about Collins Aerospace the record does not support
Widely repeated claim
What the record says
"Two experts independently confirmed it was HardBit ransomware."
Two social media posts, the second crediting the first, with no source given. No company or government has named the ransomware, and Everest separately claimed a data theft.7,8,9,10
"The Everest ransomware gang was behind the airport disruption."
A leak-site claim of data theft, reported in October 2025. Unconfirmed by Collins, RTX or any government, and unreconciled with the HardBit assertion.7
"The attack hit 170 or more airports."
Untraceable to any document; at best an installed base, not an impact. Four airports are documented as disrupted.2,3,4,5
Did RTX report the incident as material?
No. RTX stated the incident "has not had a material impact and is not reasonably expected to have a material impact."1 It filed under Form 8-K Item 8.01, Other Events, rather than Item 1.05, the item for material cybersecurity incidents. Filing under Item 8.01 is consistent with RTX's own materiality statement and is evidence of nothing else. No cost has been disclosed.
BlastWave analysis: the fallback worked; the open question is the platform's
Analysis, not a disclosed fact
Most entries in Hackopedia are about a system that should not have been reachable. This one is about what happened after one was. At a common-use airport, airlines share check-in counters, gates and bag drops, and the software that runs them belongs to a vendor. That is efficient and sensible, and it means one vendor's bad night is every airline's bad night at once. What the record shows is a fallback that worked: the vendor named it on the first day, Brussels ran check-in on laptops and iPads, and Heathrow said the vast majority of its flights were operating as normal. At the Port of Nagoya, quay work went on by hand but the truck gate had no manual form, and the gate is what halted. What differed most was the fallback.3,5
The airports and airlines acted well. The open architectural question belongs to the shared platform: how one incident reached several airports' own networks has never been disclosed, and it is the question every operator on a shared platform should put to its vendor. That the fallback, rather than any security control, is what kept flights moving is BlastWave's reading of the public record, not a disclosed finding.
Podcast: “The Bike Share” (8:59). Joe Baxter and Cam Cullen on why a shared platform failed every airline at once, and why the airports kept flying anyway.
Video: Collins Aerospace Short (60 to 90 seconds).
Frequently asked questions
What happened in the Collins Aerospace cyberattack?
RTX said in an SEC filing on 24 September 2025 that on 19 September it became aware of ransomware on systems supporting MUSE, Collins Aerospace's shared passenger processing software. From 20 September, airlines at Heathrow, Brussels and Berlin moved to backup and manual check-in, and Dublin was also disrupted. Flights were delayed and cancelled, but operations continued, and RTX said the incident had not had a material impact.
Which airports were affected by the Collins Aerospace attack?
Four airports are documented as disrupted: London Heathrow, Brussels, Berlin Brandenburg and Dublin. The Irish operator daa also said on 20 September 2025 that Cork faced minor impact. The widely circulated figure of 170 or more airports cannot be traced to any document and at best describes how many airports run the software, not how many were disrupted.
Were flights cancelled because of the Collins Aerospace ransomware?
Yes, but flights were not stopped. Euronews reported that Brussels Airport cancelled 25 departures on Saturday 20 September 2025, and the airport asked airlines to cancel about half of Monday's departures. Heathrow said on 22 September that the vast majority of its flights were operating as normal. RTX's filing says customers shifted to back-up or manual processes and experienced certain flight delays and cancellations.
Who was behind the Collins Aerospace attack?
As of late September 2026, no company or government has named the attacker. ENISA said on 22 September 2025 that the type of ransomware had been identified but did not name it. Researchers asserted HardBit in social media posts without a source, and the Everest group claimed a data theft on its leak site in October 2025. The two claims have never been reconciled or confirmed.
Was anyone arrested for the Collins Aerospace cyberattack?
The UK National Crime Agency said on 24 September 2025 that a man in his forties had been arrested in West Sussex the previous evening on suspicion of Computer Misuse Act offences and released on conditional bail. No charge is publicly recorded as of late September 2026, and the NCA has not linked him to either ransomware claim.
Did the Collins Aerospace attack affect aircraft or air traffic control?
Nothing on the public record touched aircraft, flight operations systems or air traffic control. The systems involved supported MUSE, which airlines use to share check-in, gate and baggage resources. RTX's filing, filed 24 September 2025, describes customers moving to back-up or manual processes, with flight delays and cancellations, not any effect on aircraft.
How much did the Collins Aerospace incident cost?
No cost has been disclosed. RTX stated in its Form 8-K, filed 24 September 2025 under Item 8.01, that the incident has not had a material impact and is not reasonably expected to have a material impact. Filing under Item 8.01 rather than Item 1.05 is consistent with that statement and indicates nothing more.
Primary sources are RTX's SEC filing and the statements of the National Crime Agency, ENISA and the affected airports. ENISA's statement and several company and airport statements are cited as carried by named outlets because the originals were not all retrieved; press is otherwise cited only as evidence of what was said or claimed.
Company filingRTX Corporation, Form 8-K, date of report 19 September 2025, filed 24 September 2025, Item 8.01 (Other Events). SEC accession 0000101829-25-000036. sec.gov
PressEuronews, "Cyberattack causes disruptions at major European airports," 20 September 2025, carrying Brussels Airport's statement that the attack took place on Friday night, 19 September, and Berlin Brandenburg Airport's warning of longer waiting times at check-in. Berlin Brandenburg's statement was also carried by AP. euronews.com
PressReuters, as carried by CBC News, 20 September 2025: Collins Aerospace's statement that the impact was limited to electronic customer check-in and baggage drop and could be mitigated with manual check-in operations; Brussels Airport's first report of 10 cancellations and an average departure delay of one hour; daa's statement of minor impact at Dublin and Cork. Collins's statement was also carried by ITV News and AP. cbc.ca
PressEuronews, "Brussels Airport asks airlines to cancel half of Monday's flights," 21 September 2025: 25 departures and 13 arrivals cancelled on Saturday and 45 departures on Sunday; airlines asked to cancel half of Monday's departures. euronews.com
PressCSO Online, 22 September 2025, carrying Brussels Airport's statement that check-in was "mainly done with laptops and iPads" and that Collins was "not yet able to deliver a new secure version," and Heathrow's statement that "the vast majority of flights at Heathrow are operating as normal." csoonline.com
GovernmentNational Crime Agency, "UK arrest following aerospace cyber incident," 24 September 2025. nationalcrimeagency.gov.uk
PressCybernews, report on Everest leak-site posts claiming a data theft from Collins, 18 October 2025 (updated 20 October), and further posts reported 12 November 2025. Cited as evidence of what was claimed. cybernews.com
PressENISA statement, 22 September 2025: "The type of ransomware has been identified. Law enforcement is involved to investigate." As reported by Reuters and DW; the link is to Security Affairs, "EU agency ENISA says ransomware attack behind airport disruptions," which carries the statement verbatim. Cited as evidence of what was said. securityaffairs.com
PressInfosecurity Magazine, "NCA Arrest Man as HardBit Ransomware Blamed for Airport Outages," 25 September 2025, reporting Kevin Beaumont's Mastodon post naming HardBit, posted "without sources." Cited as evidence of what was said. infosecurity-magazine.com
PressSecurityWeek, "RTX Confirms Airport Services Hit by Ransomware," 25 September 2025, reporting that Kevin Beaumont and Dominic Alvieri had "independently confirmed" HardBit; Alvieri's X post credits Beaumont. Cited as evidence of what was said. securityweek.com
PressAviation24.be, 24 September 2025, carrying Brussels Airport's statement that a replacement check-in system planned for November would roll out from 29 September, with about 500 workstations. aviation24.be
PressEuronews Next, "What do we know about the cyberattacks that hit Europe's airports?", 21 September 2025, reporting staff "handwriting boarding passes or using backup laptops." Cited as evidence of what was reported. euronews.com
Cite this page
BlastWave. “Collins Aerospace Ransomware Incident at European Airports (2025): What Is Verified.” Hackopedia, Volume 2, FILE 046. Last verified 28 September 2026. https://hackopedia.blastwave.com/transportation-logistics/collins-aerospace-2025/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 046 in Hackopedia Volume 2, in the Transportation and Logistics edition.
2 Oct 2026
The Scale field now records the minor impact daa reported at Cork alongside the four airports documented as disrupted.
28 Sep 2026
Hand-check against the primary record: RTX's Form 8-K was read at sec.gov and the quotation on customers' back-up or manual processes now matches the filing exactly. daa's statement on Dublin and Cork was confirmed in wire copy.
26 Sep 2026
Full validation of every claim against its source. Brussels Airport's 10 cancellations are now described as its first report on 20 September rather than the day's total (25 departures were cancelled that day), and the HardBit name is attributed to researchers' social media posts, the second crediting the first, rather than to one researcher.
24 Sep 2026
Volume 2 entry built from primary sources: RTX's SEC filing, the National Crime Agency, ENISA, and the airports' own statements as carried by named outlets.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
