The Collins Aerospace MUSE outage shows how one shared supplier system can push many airports into manual check-in at the same time. RTX said it became aware on 19 September 2025 of a ransomware incident on systems that support MUSE, software that lets airlines share check-in and gate resources. Buyers should ask which supplier systems could stop their own operations.
What happened with Collins Aerospace and MUSE?
In its SEC Form 8-K, RTX said it became aware on 19 September 2025 of a product cybersecurity incident involving ransomware on systems that support its Multi-User System Environment, known as MUSE. RTX described MUSE as software that lets multiple airlines share check-in and gate resources at airports, including baggage handling. The UK National Crime Agency (NCA) said the incident affected flights at Heathrow and other European airports over the weekend. Our Collins Aerospace MUSE incident page holds the full account; this post looks at what a security buyer can take from it.
RTX said its customers shifted to back-up or manual processes and had some flight delays and cancellations. It also said the incident had not had, and was not reasonably expected to have, a material impact on its own financial condition, operations or results.
The NCSC (UK) published a statement on 20 September 2025, saying it was working with Collins Aerospace, affected UK airports, the Department for Transport and law enforcement. On 24 September the NCA announced that a man in his forties had been arrested in West Sussex on suspicion of Computer Misuse Act offenses and released on conditional bail. The head of the NCA National Cyber Crime Unit said the investigation was in its early stages and ongoing.
How long did the recovery take?
Berlin Brandenburg Airport (BER) published regular updates, which give a useful view of the customer side. On 21 September it said some airlines were checking in passengers manually while others used their own check-in systems. It also said 19 airlines could use its self-service kiosks to check in and print boarding passes.
- 19 September 2025RTX becomes aware of a ransomware incidentOn systems that support MUSE.
- 21 September 2025BER reports a malfunction at an external passenger handling providerSome airlines check in manually, others use their own systems.
- 22 September 2025BER reports departure delays mostly under an hourThe Berlin Marathon adds to passenger numbers.
- 24 September 2025BER says the provider may need several more daysTo provide functional and secure software.
- 2 October 2025BER says Collins Aerospace aims to restore the system by 5 OctoberSecurity tests by the airport IT department, then airlines reconnect step by step.
The fallback processes shaped the outcome. On 22 September BER said it expected almost 93,000 travelers and warned of longer waits at manual check-in and baggage, yet departure delays were mostly under an hour. A change in procedures let baggage be sorted automatically by flight again from the morning of 23 September. BER also said the airline is the central contact for undelivered checked baggage, and that baggage was left behind because of the attack.
Recovery ran past the first weekend. On 24 September BER said check-in and boarding were still largely manual. On 2 October it said almost all flights could take place, but check-in, boarding and baggage reclaim might still be slow over the long weekend.
Why can one supplier system disrupt so many airports?
MUSE is shared by design: RTX says it lets multiple airlines share check-in and gate resources. When the shared platform fails, every airline and airport that depends on it feels the same failure together. ENISA says the incident disrupted automated check-in systems at several EU airports, including Brussels and Berlin, causing delays, cancellations and manual check-in.
There is also a visibility question. RTX said the MUSE airport systems operate outside its enterprise network, on customer-specific networks. For a buyer, that raises a check: for each supplier platform you depend on, who monitors it, and does your own monitoring cover it?
Where could the chain have been caught?
The public record is not fully consistent. RTX described a ransomware incident. The ENISA Threat Landscape 2026, published in September 2026, lists the September 2025 Collins Aerospace hack as a cyberattack by the Everest Group, attributed by ENISA, and describes the access as unauthorized FTP access to vMUSE check-in and boarding software infrastructure.
ENISA also calls this the most significant ransomware case against the transport sector in its data. If the access route was file transfer, as ENISA’s account points out, then file transfer access to supplier-run systems is where monitoring would look. A fair question for a supplier: who watches FTP and file transfer services on the systems you run for us, and how would we learn of unusual access?
What should a security buyer ask suppliers?
The NCSC urged all organizations to use its free guidance, services and tools. Alongside that, these questions come straight from what airports and RTX reported.
- Which shared supplier systems can stop us?Airlines shared one platform, MUSE, for check-in and gate resources.
- Where does it run and who watches it?RTX said MUSE airport systems run on customer-specific networks, outside its enterprise network.
- How fast must the supplier tell us?RTX says it became aware on 19 September 2025, and the NCA says airports were hit over that weekend.
- Can we run by hand, and for how long?Customers moved to manual processes; BER still described check-in as largely manual on 24 September.
- How do we reconnect safely?BER planned security tests by its IT department, then step by step reconnection of airlines.
The last point matters because recovery was not a single switch. BER said that after restoration, its IT department would run extensive security tests before airlines were reconnected step by step. Agreeing those tests before an incident is easier than designing them in the middle of one.
To go further, read the Jaguar Land Rover attack and the Bybit theft.