UK Man Arrested Over Ransomware Attack Disrupting European Airports

A man in his 40s has been arrested in the United Kingdom in connection with a widespread cyberattack that disrupted airport operations across Europe over the past weekend. Authorities say the attack impacted key airline check-in systems, causing delays and operational challenges for passengers and airport staff.

The arrest was made late Tuesday in West Sussex, England, under suspicion of offenses involving the misuse of computers. The investigation is being conducted by the UK’s National Crime Agency (NCA), which has confirmed that the case involves violations under the Computer Misuse Act, a law designed to prevent unauthorized access and interference with computer systems.

Disruption to Airport Operations

The cyberattack specifically targeted software provided by Collins Aerospace, a U.S.-based company that supplies check-in desk technology and other airport systems. The disruption affected several major airports across Europe, including facilities in Brussels, London, and Berlin.

Passengers at affected airports experienced difficulties in printing boarding passes and bag tags, as well as dispatching their luggage. While most flights continued to operate, travelers were advised to check flight statuses and use alternative check-in options wherever possible.

Heathrow Airport confirmed the disruption, stating that airport staff and airline partners were working to resolve the outage. “Work continues to resolve and recover from Friday’s outage of a Collins Aerospace airline system that impacted check-in,” an airport statement read. “We apologize to those who have faced delays, but by working together with airlines, the vast majority of flights have continued to operate.”

Ransomware Identified as Cause

European cybersecurity authorities have indicated that the attack involved ransomware, a type of malicious software that locks data and systems until the victim pays a ransom for access restoration. The European Union Agency for Cybersecurity (ENISA) confirmed that law enforcement agencies are investigating the incident and working to trace the origin of the attack.

Ransomware attacks have become increasingly common in recent years, often targeting critical infrastructure and organizations that rely heavily on digital operations. Such attacks can cause significant financial losses, operational delays, and reputational damage.

NCA Statement and Investigation

Paul Foster, deputy director of the National Crime Agency, emphasized that while the arrest is a positive development, the investigation remains in its early stages. Cybercrime is a persistent global threat that continues to cause significant disruption in the U.K. Alongside our partners here and overseas, the NCA is committed to reducing that threat to protect the British public,” Foster said.

The suspect was released on conditional bail pending further investigation. UK authorities are coordinating with international partners to determine the full scope of the cyberattack and identify any additional individuals involved.

Background on Collins Aerospace

Collins Aerospace is a major provider of technology solutions to airlines and airports, including check-in systems, boarding equipment, and baggage handling software. A disruption to its systems can have wide-reaching consequences for airports that rely on its software to manage daily operations efficiently.

The September 20 cyber incident underscores the vulnerability of critical aviation infrastructure to digital threats and highlights the importance of robust cybersecurity measures across the transportation sector.

Impact on Passengers and Airlines

The attack caused inconvenience for passengers attempting to travel during the weekend. Many travelers reported long queues at airport check-in counters, delays in luggage processing, and difficulties accessing flight information. Airlines advised customers to use mobile check-in apps or online boarding pass options to reduce the impact of the outage.

Despite the disruption, most flights continued as scheduled, demonstrating the resilience of airport operations and the effectiveness of contingency measures put in place by airlines and airport authorities.

Broader Implications of Cybercrime in Aviation

This incident is part of a growing trend of cyberattacks targeting critical infrastructure, including transportation, healthcare, and energy sectors. Experts warn that such attacks not only disrupt operations but can also pose safety risks if critical systems are compromised.

The attack on European airports highlights the global nature of cybercrime and the need for international cooperation in tracking and prosecuting cybercriminals. Ransomware attacks, in particular, remain a major challenge for law enforcement and cybersecurity agencies, requiring rapid response and extensive investigation to mitigate damage.

The NCA and its international partners are continuing to investigate the origins of the attack, the methods used, and any potential links to other cybercrime activities. While the recent arrest marks a step forward in the investigation, authorities caution that the case is far from concluded.

Passengers and airlines are being encouraged to remain vigilant, adopt robust cybersecurity practices, and report any suspicious digital activity to relevant authorities. The incident serves as a reminder of the increasing sophistication of cyber threats and the importance of preparedness in mitigating their impact on critical infrastructure.