bbc.com
Imran Rahman-JonesTechnology reporter andJoe TidyCyber correspondent, BBC World Service
The National Crime Agency (NCA) said a man in his forties was arrested in West Sussex.
A person has been arrested in connection with a cyber-attack which has caused days of disruption at several European airports including Heathrow.
The National Crime Agency (NCA) said a man in his forties was arrested in West Sussex "as part of an investigation into a cyber incident impacting Collins Aerospace".
There have been hundreds of flight delays after Collins Aerospace baggage and check-in software used by several airlines failed, with some boarding passengers using pen and paper.
"Although this arrest is a positive step, the investigation into this incident is in its early stages and remains ongoing," said Paul Foster, head of the NCA's national cyber crime unit.
The man was arrested on Tuesday evening on suspicion of Computer Misuse Act offences and has been released on bail.
The BBC has seen an internal memo sent to airport staff at Heathrow about the difficulties software provider Collins Aerospace is having bringing their check-in software back online.
The US company appears to be rebuilding the system again after trying to relaunch it on Monday.
Collins Aerospace's parent company RTX Corporation told the BBC it appreciated the NCA's "ongoing assistance in this matter".
The US firm has not put a timeline on when it will be ready and is urging ground handlers and airlines to plan for at least another week of using manual workarounds.
At Heathrow, extra staff have been deployed in terminals to help passengers and check-in operators but flights are still experiencing delays.
On Monday, the EU's cyber-security agency said ransomware had been deployed in the attack.
Ransomware is often used to seriously disrupt victims' systems and a ransom is demanded in cryptocurrency to reverse the damage.
These types of attacks are an issue for organisations around the country, with organised cyber-crime gangs earning hundreds of millions of pounds from ransoms every year.
Days of disruption
The attack against US software maker Collins Aerospace was discovered on Friday night and resulted in disruption across many European airports, including in Brussels, Dublin and Berlin.
Flights were cancelled and delayed throughout the weekend, with some airports still experiencing effects of the delays into this week.
"The vast majority of flights at Heathrow are operating as normal, but we encourage passengers to check the status of their flight before travelling to the airport," Heathrow Airport said in a statement on its website.
Berlin Airport said on Wednesday morning "check-in and boarding are still largely manual", which would result in "longer processing times, delays, and cancellations by airlines".
While Brussels Airport advised passengers to check in online before arriving at the airport.
Cyber-attacks in the aviation sector have increased by 600% over the past year, according to a report by French aerospace company Thales.
The Guardian
Lauren Almeida
Mon 22 Sep 2025 13.19 CEST
First published on Mon 22 Sep 2025 10.03 CEST
Software provider Collins Aerospace completing updates after Heathrow, Brussels and Berlin hit by problems
Flight delays continue across Europe after weekend cyber-attack
Software provider Collins Aerospace completing updates after Heathrow, Brussels and Berlin hit by problems
Passengers are facing another day of flight delays across Europe, as big airports continue to grapple with the aftermath of a cyber-attack on the company behind the software used for check-in and boarding.
Several of the largest airports in Europe, including London Heathrow, have been trying to restore normal operations over the past few days after an attack on Friday disrupted automatic check-in and boarding software.
The problem stemmed from Collins Aerospace, a software provider that works with several airlines across the world.
The company, which is a subsidiary of the US aerospace and defence company RTX, said on Monday that it was working with four affected airports and airline customers, and was in the final stages of completing the updates needed to restore full functionality.
The European Union Agency for Cybersecurity said on Monday that Collins had suffered a ransomware attack. This is a type of cyber-attack where hackers in effect lock up the target’s data and systems in an attempt to secure a ransom.
Airports in Brussels, Dublin and Berlin have also experienced delays. While kiosks and bag-drop machines have been offline, airline staff have instead relied on manual processing.
The government’s independent reviewer of terrorism legislation, Jonathan Hall KC, said it was possible state-sponsored hackers could be behind the attack.
When asked if a state such as Russia could have been responsible, Hall told Times Radio “anything is possible”.
He added that while people thought, “understandably, about states deciding to do things it is also possible for very, very powerful and sophisticated private entities to do things as well”.
A spokesperson for Brussels airport said Collins Aerospace had not yet confirmed the system was secure again. On Monday, 40 of its 277 departing flights and 23 of its 277 arriving services were cancelled.
A Heathrow spokesperson said the “vast majority of flights at Heathrow are operating as normal, although check-in and boarding for some flights may take slightly longer than usual”.
They added: “This system is not owned or operated by Heathrow, so while we cannot resolve the IT issue directly, we are supporting airlines and have additional colleagues in the terminals to assist passengers.”
Indonesian President Joko Widodo ordered on Friday an audit of government data centres after officials said the bulk of data affected by a recent ransomware cyberattack was not backed up, exposing the country's vulnerability to such attacks.
Last week's cyberattack, the worst in Indonesia in recent years, has disrupted multiple government services including immigration and operations at major airports.
A cyber attacker compromised Indonesia's national data centre, disrupting immigration checks at airports, and asked for an $8 million ransom, the country's communications minister told Reuters on Monday.
The attack disrupted several government services, most notably at airports last week, with long lines forming at immigration desks. Automated passport machines were now functioning, the communications ministry said.
Specialists with the Ukrainian Defense Ministry's Main Intelligence Directorate (HUR) carried out a cyberattack on the websites of Russian government agencies and Russian airports on "Russia Day," with a number of flights being delayed. — Ukrinform.
A series of distributed denial-of-service (DDoS) attacks shut down seven German airports' websites on Thursday, a day after a major IT glitch at Lufthansa grounded flights.
