A Cyberattack Grounded Europe’s Airports: What Really Happened

When a cyberattack hits an airport, the ripple effects are immediate. Thousands of passengers stranded, airlines scrambling, and national infrastructure tested. That is exactly what Europe witnessed on September 19, 2025, when a disruption at a key service provider knocked out check-in and boarding systems at multiple airports.

The Players Behind the Incident

At the center is Collins Aerospace, a global provider of passenger-processing systems. Its MUSE software runs critical functions like check-in, baggage tagging, and boarding pass issuance at airports worldwide. When it went down, Brussels Airport, Berlin Brandenburg Airport, and London Heathrow were among the hardest hit. Cybersecurity agencies in Germany and the UK are now investigating.

The Systems That Went Dark

The attack disrupted electronic check-in and baggage handling, forcing airports to fall back on manual processes. For travelers, that meant standing in long lines, waiting for paper boarding passes, and watching flights slip off schedule. What looks like a small IT outage on paper quickly became an operational choke point for tens of thousands of people.

The Moment It All Unfolded

The disruption began on Friday night, September 19, 2025, and carried into Saturday, September 20. Brussels reported nine cancellations, four diversions, and at least 15 serious delays by the next morning. Other airports braced for ripple effects as the weekend travel rush intensified.

The Airports Under Pressure

The impact was most visible at Brussels, where 35,000 passengers were expected to depart on Saturday alone. Berlin Brandenburg saw long check-in queues but avoided outright cancellations. Heathrow, Europe’s busiest hub, reported “minimal” disruption thanks to backup systems used by some airlines. Still, the sight of manual check-ins at one of the world’s most advanced airports underscored the severity of the issue.

The Deeper Cause: A Single Point of Failure

This incident was not about one airline or one country. It was about concentration risk. When multiple airports across Europe depend on the same vendor, a single compromise becomes a continental problem. Manual fallback options can soften the blow, but they cannot scale to modern passenger volumes. This is why attackers see such third-party service providers as high-value targets.

The Key Learning: Supply Chain Resilience is Everything

The lesson is clear: resilience is not just about defending your own perimeter. It is about knowing and testing the security of your partners and providers.

To move forward, airports and airlines must:

Map and understand vendor dependencies.
Build redundant systems that can take over quickly.
Regularly stress-test contingency plans under realistic conditions.
Demand higher security standards from third-party providers.

ThreatMon’s Take

Cyberattacks like this prove that supply chain risk is no longer a theory. Threat actors know that hitting one vendor can create chaos across borders and industries. With ThreatMon’s supply chain intelligence, organizations can monitor vendor exposure, detect early warning signals, and protect themselves before a disruption becomes a crisis.