Operator of Ransomware Involved in European Airport Disruptions Arrested
The British National Crime Agency (NCA) has arrested a suspect linked to a ransomware attack that disrupted operations at several European airports earlier this week.
Late last week, hackers targeted Collins Aerospace, the American company behind the ARINC SelfServ vMUSE system—self-service kiosks used by passengers to check in, drop off baggage, and print boarding passes. Collins reported an “outage related to a cyberattack,” which caused software failures in “certain airports in Europe.”
As a result, beginning Friday, September 19, 2025, airports in Berlin, Brussels, and London experienced significant disruptions to their electronic systems. The breakdown paralyzed check-in operations and forced airline staff to rely on alternatives—such as filling out boarding passes by hand or using additional laptops. The impact varied across locations, depending on how many vMUSE devices were deployed.
Brussels Airport was the hardest hit. The facility announced that it had asked airlines to cancel approximately 140 flights scheduled for Monday, September 22, explaining that its U.S. software provider “cannot provide a new secure version of the check-in system.” The airport also reported 25 canceled flights on Saturday and another 50 on Sunday.
While Collins Aerospace did not disclose details, cybersecurity expert Kevin Beaumont stated that the attackers used an “incredibly primitive” strain of ransomware known as Hardbit. However, Bleeping Computer, citing its own sources, suggested the incident may have involved the Loki ransomware family instead.
The NCA confirmed that the arrest was made as part of its investigation into the attack on Collins Aerospace and its parent company, RTX Corporation. A 40-year-old man, whose name has not been released, was detained in West Sussex on suspicion of violating the Computer Misuse Act. He has since been released on bail.
“While this arrest is a significant step, the investigation into the incident is still in its early stages and is ongoing,” law enforcement officials said in a statement.
