A ransomware attack was behind the cyber disruptions that crippled check-in systems at major European airports since Friday, the EU Agency for Cybersecurity (ENISA) confirmed on Monday.
Automated check-in platforms supplied by Collins Aerospace were targeted, affecting operations at hubs including Brussels, London Heathrow, and Berlin Brandenburg. While Collins said fixes are nearly complete, Berlin continued to face hour-long departure delays, and Brussels cancelled 60 flights out of 550 scheduled on Monday.
The attack forced airlines to revert to manual processes, with laptops and iPads used to check in passengers.
ENISA said law enforcement agencies are investigating the ransomware variant, though its origin remains unclear. Analysts note ransomware groups increasingly target high-profile infrastructure, but warn that large-scale incidents with physical-world impact remain rare.
The incident underscores rising cyber risks for Europe’s aviation sector, with German industry group Bitkom estimating that ransomware payments in 2025 have already hit a record €202 billion.