Fraud Management & Cybercrime
,
Ransomware
Major European Airports Continue to Face Service Disruptions Following Friday Hack
European cyber defenders classified as a ransomware attack an incident that disrupted several major European airports including London Heathrow resulting in flight cancelations and delays over the weekend and Monday.
See Also: Preparing for the Next Attack
Still unidentified hackers late on Friday compromised Muse software developed by U.S.-based Collins Aerospace that allows multiple airlines to share check-in desks and boarding gates (see: Cyberattack Disrupts Services at Major European Airports).
The European Union’s Agency for Cybersecurity, known as ENISA, said Monday that ransomware actors targeted a Collins Aerospace third-party provider. “ENISA is aware of the ongoing disruption of airport operations. The cyberattack is confirmed to be a ransomware attack,” the agency said in an emailed statement.
Collins Aerospace parent company RTX has not formally disclosed the incident but acknowledged to media outlets a “cyber-related disruption to Muse software in select airports.”
ENISA and the U.K. National Cyber Security Centre are working with the company to restore affected systems. The BBC reported Monday that Collins Aerospace is in the final stages of deploying a software update to restore full functionality of Muse.
Disruptions at Berlin and London Heathrow airports eased significantly by Sunday, the BBC also reported. Berlin Brandenburg avoided widespread cancellations on Monday, but the hack is still causing operational delays, Der Spiegel reported.
Brussels Airport told passengers the cyberattack on Collins Aerospace would have “limited impact” on operations on Monday and Tuesday.
“Work continues to resolve and recover from the outage of a Collins Aerospace airline system that impacted check-in,” Heathrow Airport authorities tweeted, adding that majority of flights are taking off. An internal memo seen by the BBC sent to Heathrow staff stated that more than a thousand computers may have been “corrupted” by the attack and that the work of bringing them back online mostly cannot be done remotely.
The ransomware attack has also affected Ireland’s Dublin and Cork Airports.
The incident comes in the wake of growing cyberattacks targeting the aviation transport sector. Hacking group ShinyHunters – linked to the adolescent cybercrime collective “The Com” – stole in August data of European carriers Air France and KLM. Scattered Spider, also tied to The Com, targeted Australia’s Qantas in July, prompting its CEO to take a pay cut of nearly $2 million (see: ).
Collins Aerospace itself underwent a putative ransomware attack by the BianLian ransomware operation in 2023. “This attack was never confirmed by the company but BianLian alleged to have stolen around 20 gigabytes of data from the organization at the time,” said Rebecca Moody, head of data research at Comparitech. The group listed Collins Aerospace on its data leak site and said it stole business files and employee details.