Article
Check-in outage: one supplier, many airports
The Collins Aerospace MUSE outage pushed European airports into manual check-in. Here is what a security buyer should ask about shared supplier systems.
Read more
Significant cyber incident
Collins Aerospace MUSE attack on European airports
On 19 September 2025 RTX found a ransomware incident on systems that support Collins Aerospace's MUSE software, which lets airlines share check-in and boarding resources at airports.
In short
On 19 September 2025 RTX found a ransomware incident on systems that support Collins Aerospace's MUSE software, which lets airlines share check-in and boarding resources at airports. Airports including Heathrow, Brussels and Berlin lost automated check-in and fell back to manual work, causing delays and cancellations. RTX told the SEC it had no material financial impact, and the UK National Crime Agency arrested a man in his forties. One shared supplier system disrupted many airports.
What happened
On 19 September 2025 RTX, the parent of Collins Aerospace, became aware of a product cybersecurity incident involving ransomware on systems that support its MUSE passenger processing software. MUSE lets several airlines share check-in and gate resources at an airport, including baggage handling.
The UK National Crime Agency said the incident affected flights at Heathrow and other European airports over the weekend. Berlin Brandenburg Airport described a cyber attack on its system partner Collins Aerospace. ENISA’s 2026 threat report names Brussels and Berlin among the EU airports that moved to manual check-in.
RTX said customers moved to back-up or manual processes and had some flight delays and cancellations. On 24 September 2025 the NCA announced an arrest. Berlin Airport said on 2 October that Collins Aerospace aimed to restore the central system by 5 October 2025.
Timeline
-
19 September 2025
RTX becomes aware of a ransomware incident on systems that support MUSE passenger processing software.
-
20 September 2025
The NCSC (UK) publishes a statement saying it is working with Collins Aerospace, affected UK airports, the Department for Transport and law enforcement.
-
21 September 2025
Berlin Brandenburg Airport reports a malfunction at an external passenger handling provider. Some airlines check in manually, others use their own systems.
-
22 September 2025
Berlin Airport says the cyber incident hit an external provider's system on Friday evening and that delays are mostly under an hour.
-
23 September 2025
Berlin Airport says it sorted baggage automatically again after a change in procedures (reported 24 September as "early yesterday morning").
-
24 September 2025
The NCA announces the arrest of a man in his forties in West Sussex on suspicion of Computer Misuse Act offenses. He is released on conditional bail.
-
24 September 2025
RTX signs its SEC Form 8-K, saying the incident is not expected to have a material impact on the company.
-
24 September 2025
Berlin Airport says the provider warned it may take several more days to provide functional and secure software.
-
2 October 2025
Berlin Airport says Collins Aerospace aims to restore the central handling system by Sunday 5 October, followed by security tests and step-by-step reconnection of airlines.
-
September 2026
ENISA's Threat Landscape 2026 calls the incident the most significant ransomware case against the transport sector and lists it as an Everest Group attack.
How the attack worked
What is public about the method
Public sources say little about the technical steps. RTX’s SEC filing says the incident was ransomware on systems that support MUSE, and that the MUSE airport systems run outside the RTX enterprise network, on customer-specific networks.
The ENISA account
ENISA’s Threat Landscape 2026 lists the event as a cyberattack by the Everest Group that gained unauthorized FTP access to vMUSE check-in and boarding software infrastructure. The same table entry lists exfiltration of over 1.5 million passenger records and 3 637 airline employee records. RTX’s filing and the NCA release do not say this, so treat it as ENISA’s statement only.
Why it spread
MUSE is shared by several airlines at an airport. When the supplier’s system was down, airports moved check-in, boarding and baggage work to manual processes or to airline systems.
No opened source names a MITRE ATT&CK technique, so none is listed here.
Who says who was behind it
No public attribution by the UK NCA, the NCSC (UK) or RTX in the pages opened. The NCA only says a man in his forties was arrested on suspicion of Computer Misuse Act offenses and released on conditional bail (24 September 2025).
Attributed by ENISA, September 2026 (Threat Landscape 2026): the Everest Group, through unauthorized FTP access to vMUSE infrastructure.
Sources differ: RTX's 8-K (24 September 2025) describes a ransomware incident, while ENISA's incident table describes an Everest Group attack with data exfiltration. The opened sources do not reconcile these.
Impact
Operations: RTX says customers shifted to back-up or manual processes and had flight delays and cancellations (SEC 8-K, 24 September 2025). The NCA says Heathrow and other European airports were affected over the weekend of 19 September 2025.
Berlin Brandenburg Airport: delays on 22 September were mostly under an hour, with almost 93,000 travelers expected that day. By 24 September check-in and boarding were still largely manual. Baggage was left behind and travelers were told to contact their airline.
ENISA (September 2026): the incident disrupted automated check-in at several EU airports, including Brussels and Berlin, with delays, cancellations and manual check-in.
Data: ENISA's table lists over 1.5 million passenger records and 3 637 airline employee records as exfiltrated. This figure does not appear in RTX's filing.
Financial: RTX says no material impact on its financial condition, operations or results.
Government and regulator response
- 19 to 24 September 2025, RTX: activated its incident response plan, investigated with internal and external experts, notified domestic and international law enforcement and certain government agencies, and supported affected airlines and airports (SEC 8-K).
- 20 September 2025, NCSC (UK): said it was working with Collins Aerospace, affected UK airports, the Department for Transport and law enforcement, and urged all organizations to use its free guidance.
- 24 September 2025, NCA: arrested a man in his forties in West Sussex on suspicion of Computer Misuse Act offenses. He was released on conditional bail. The NCA said the investigation was at an early stage.
- 21 September to 2 October 2025, Berlin Airport: used manual check-in, self-service kiosks and changed baggage procedures. It said Collins Aerospace aimed to restore the central system by 5 October, with security tests and step-by-step airline reconnection after that.
Lessons
-
One shared supplier can stop many airports
RTX says MUSE lets several airlines share check-in and gate resources. The NCA reports effects at Heathrow and other European airports from one incident.
-
Fallback processes decide how bad it gets
Customers moved to back-up or manual processes. Berlin Airport kept most delays under an hour on 22 September, helped by manual check-in and self-service kiosks.
-
Recovery takes longer than the first weekend
On 24 September the provider said functional and secure software might take several more days. On 2 October the goal was 5 October.
-
Test before you reconnect
Berlin Airport said the restored system would face extensive security tests by its IT department before airlines were reconnected step by step.
-
Supplier systems may sit outside your own network
RTX says MUSE airport systems run on customer-specific networks, outside the RTX enterprise network. Your own monitoring may not cover them.
-
Early public facts are thin
Sources differ on the nature of the event (ransomware per RTX, Everest Group data theft per ENISA). Plan for uncertainty in the first days.
What to check in your own organization
-
List shared supplier systems
Find which third-party platforms several of your teams or sites depend on, like MUSE for check-in. Note who owns each and how it is hosted.
-
Test manual fallback
Run an exercise where a key supplier system is offline. Time how long manual work takes and what queues it creates.
-
Know where supplier systems run
Ask each supplier whether its software runs on your networks or theirs, and who monitors it, as with MUSE on customer-specific networks.
-
Check remote file transfer access
ENISA lists unauthorized FTP access to vMUSE. Review exposed FTP and file transfer services for your suppliers and for you.
-
Agree incident contacts and notice terms
Confirm how fast a supplier must tell you about an incident, and who contacts regulators and law enforcement for you.
-
Plan a staged reconnect
Define security tests you will run before a restored supplier system rejoins your network, as Berlin Airport described.
-
Check what data the supplier holds about you
ENISA lists passenger and employee records in this case. Map which of your customer and staff data sits in supplier platforms.
Where it happened
- Industry Aviation and travel Fake booking and loyalty pages, account takeover, phishing of travelers and supplier outages, plus the rules that apply to airlines and travel brands.
- Country Germany Germany faces cyber espionage by state actors, ransomware against companies and local governments, and DDoS campaigns against critical infrastructure. Europe
- Country United Kingdom The United Kingdom faces cyber threats from states and from ransomware crews. Europe
Questions
What happened to Collins Aerospace in September 2025?
RTX says it became aware on 19 September 2025 of a ransomware incident on systems that support its MUSE passenger processing software.
Which airports were affected?
The NCA names Heathrow and other European airports. Berlin Brandenburg Airport reported effects. ENISA names Brussels and Berlin among EU airports.
Who did it?
No attribution by the NCA, NCSC or RTX in the pages opened. ENISA's September 2026 report lists the Everest Group. Sources differ on the nature of the event.
Was anyone arrested?
Yes. On 24 September 2025 the NCA announced the arrest of a man in his forties in West Sussex on suspicion of Computer Misuse Act offenses. He was released on conditional bail.
Was data stolen?
RTX's filing does not say. ENISA's table lists over 1.5 million passenger records and 3 637 airline employee records as exfiltrated.
Did it hurt RTX financially?
RTX says it did not have, and is not expected to have, a material impact on its financial condition, operations or results.
In our research
- Check-in outage: one supplier, many airports October 2026
- The Role of Threat Intelligence in Strengthening Supply Chain Security December 2024
- Aviation and travel Industry
Sources
- UK arrest following aerospace cyber incident National Crime Agency
- NCSC statement: Incident impacting Collins Aerospace National Cyber Security Centre
- RTX Corporation Form 8-K, event date 19 September 2025 U.S. Securities and Exchange Commission (filed by RTX)
- Operations at BER calm and smooth Flughafen Berlin Brandenburg GmbH
- Operations at BER remain stable Flughafen Berlin Brandenburg GmbH
- Update: Further disruptions to flight operations expected at BER Flughafen Berlin Brandenburg GmbH
- Update on cyber attack on BER service provider Flughafen Berlin Brandenburg GmbH
- ENISA Threat Landscape 2026 ENISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.