Consultation

Case study · Aviation

Collins Aerospace: one check-in system, four airports on paper

Europe, September 2025. Ransomware hits a shared check-in system and forces Heathrow, Brussels, Berlin and Dublin onto manual processes.

In one sentenceOne check-in software vendor, four airports on paper. The manual plan B was not designed for a peak weekend.

Sector
Airports and airlines
Scope
Heathrow, Brussels, Berlin Brandenburg, Dublin
Date
From the evening of Friday 19 September 2025
Nature
Ransomware on passenger-processing software, confirmed by ENISA
Vendor
Collins Aerospace (RTX)

Analysis based solely on public information. FZ Consultation was not involved in this incident and has no affiliation with the organizations named.

What happened

  1. Friday 19 September, evening

    Check-in and baggage drop become unavailable at several European airports.

  2. Saturday 20 September

    Media report ransomware; Collins refers only to a “cyber-related attack” and does not confirm.

  3. Weekend

    Airports issue boarding passes by hand; in Berlin, a marathon with over 55,000 participants worsens the situation. Heathrow is still recovering on Sunday.

  4. Monday 22 September

    ENISA confirms ransomware targeting Collins's MUSE software. Brussels asks airlines to cancel 140 of its 276 scheduled outbound flights for the day; Dublin remains disrupted.

What went wrong

According to the public sources listed below.

One vendor, several airports

A platform shared by different customers is a common point of failure: one compromise hit several airports at once.

A manual mode not built for peak volume

Boarding passes were written by hand, with delays and cancellations. A degraded mode existed; the question is at what volume it holds.

Rebuilding with the attacker still present

According to TechRepublic's report, Heathrow said over 1,000 computers could have been affected and that Collins found the hackers were still present when it tried to rebuild the system.

Lessons for your organization

  1. 1

    Map shared platforms

    Identify the vendors whose outage would stop your business and what you would do that day.

    Know: measure what stopping would cost
  2. 2

    Rehearse manual mode at full load

    A peak-period exercise shows how many people it takes, and what breaks.

    Prove: rehearse before the real day
  3. 3

    Evict before you rebuild

    Confirm the attacker is gone before restoring, or you start over.

    Ransomware checklist

Check on Monday morning

Three questions to put to your own organization this week. If you cannot answer one of them in five minutes, that is your first task.

  1. Which platforms shared with your vendor's other customers could stop your business in one blow?
  2. Does your manual mode hold at full volume on a peak day? How many extra people does it need?
  3. Before you rebuild, how would you know the attacker is no longer in the system?
The ransomware checklist

Sources

More case studies