Cyber Attacks Hit Collins Aerospace, Used for Flight Check-Ins and Boarding

European travelers experienced multiple days of lengthy flight delays after cyber attackers hit a third-party check-in and booking system. The effects were primarily felt in London, Berlin, Brussels, and Dublin, where more than a thousand flights were delayed. At the same time, travel conditions worsened overseas with a major ATC failure in Dallas.

The disruption stemmed from Collins’ MUSE software: a passenger-processing system used by more than 300 airlines at 100 airports worldwide. RTX, the company’s parent, admitted to a “cyber-related disruption” that began the evening of Friday, September 19, forcing staff at several airports to revert to manual check-in.

Heathrow Airport reported average delays of more than half an hour, while Brussels was forced to cancel nearly half of its Saturday departures. Berlin-Brandenburg also saw hundreds of delays, and Dublin compounded its issues with a Terminal 2 evacuation prompted by a security scare.

Passengers on the ground saw the chaos in real time. At Heathrow’s Terminal 3, airport staff shouted instructions through megaphones as travelers waited for flights that were scheduled to leave minutes earlier. In Brussels, Eurocontrol confirmed that airlines were told to cut half of all departures until Monday morning to relieve pressure on the strained check-in operation. Though air traffic control itself was not affected, airlines struggled to keep flights moving on time.

By the next evening, tracking software was reporting more than 445 delays at Heathrow, 254 in Brussels, and 202 in Berlin. Dublin clocked in at more than 270 delays, averaging over an hour each. While airports attempted to assure passengers that flights were still operating, the effects of the outage rippled across Europe’s busiest hubs, clogging departure boards and leaving travelers stranded.

The cyberattack has drawn scrutiny from security officials. Britain’s National Cyber Security Centre confirmed it was working with Collins and the Department for Transport to assess the incident. In Ireland, bomb disposal units were even placed on standby after suspicious items were found during the Dublin evacuation.

A similar incident occurred last summer in the US. The CrowdStrike fiasco involved a faulty software update that caused Delta Airlines to cancel more than 5,000 flights in a single week. Multiple class-action lawsuits were filed against CrowdStrike, including Delta, which sought compensation for an estimated $550 million in losses.

FMI: www.collinsaerospace.com