The UK’s National Crime Agency (NCA) have arrested a man in his 40s in relation to a cyber-attack on a Collins Aerospace processing system that caused disruptions and cancelled flights at several European airports over the weekend.
On September 24, 2025, the NCA said that as part of an investigation into a cyber incident impacting Collins Aerospace an individual had been arrested in West Sussex, UK.
The man was arrested during the evening on September 23, 2025, on suspicion of Computer Misuse Act offences. He was later released on conditional bail.
“Although this arrest is a positive step, the investigation into this incident is in its early stages and remains ongoing. Cybercrime is a persistent global threat that continues to cause significant disruption to the UK. Alongside our partners here and overseas, the NCA is committed to reducing that threat in order to protect the British public,” said Deputy Director Paul Foster, Head of the NCA’s National Cyber Crime Unit.
On September 22, 2025, the European Union Agency for Cybersecurity (ENISA) confirmed that the cyber-attack was caused by a type of ransomware that it had identified.
London-Heathrow Airport (LHR), Brussels Airport (BRU), and Berlin Brandenburg Airport (BER) were among the heaviest disrupted airports from late on September 19, 2025, through to the following day.
The attack against Collins Aerospace’s MUSE check-in and boarding software triggered long queues, delays, and cancellations over the weekend.
On September 24, 2025, Collins Aerospace said it was “continuing to restore its onsite passenger processing software for airlines impacted by a cyber intrusion”.
“We fully recognize the challenges this disruption creates for airline operations and the additional strain on impacted airport management and have deployed all available resources to restore electronic check-ins and baggage drop operations as soon as possible. We apologize to our customers and travelers for any related inconvenience,” said a spokesperson for Collins Aerospace.
The RTX-owned company described the incident as “complex”.
“As we complete security testing, we will scale deployment of a secure passenger processing system across the affected area. This remains our top priority, and we are providing progress updates to the impacted airlines and airports, as they are available, to assist with operational planning,” added the spokesperson.
