INCIDENT REPORT · CP-2025-016
Collins Aerospace MUSE ransomware disrupts European airports
L3 · ELEVATEDCONFIRMED
Ransomware on systems supporting Collins Aerospace's MUSE shared passenger-processing software disrupted check-in and boarding at several European airports, according to ENISA and an RTX 8-K filing.
- Incident ID
- CP-2025-016
- Incident date
- 19 SEP 2025
- Detection date
- 19 SEP 2025
- Affected countries
- Belgium, United Kingdom, Germany, Ireland
- Plotted location
- Brussels Airport, Belgium (Most affected infrastructure (Brussels Airport))
- Threat classification
- Level 3 — ELEVATED
- Classification rationale
- Multi-country disruption of airport passenger processing via a third-party supplier.
- Attack type
- Ransomware
- Nature
- Malicious activity
- Attack vector
- Not publicly documented
- Sectors
- Transportation
- Critical infrastructure
- Yes
- Organizations affected
- Collins Aerospace (RTX), Brussels Airport, Heathrow Airport, Berlin Brandenburg Airport, Dublin Airport
- Operational consequences
- Airports reverted to manual check-in; Brussels Airport was worst hit and asked airlines to cancel around half of its departures on 22 September. The UK NCA arrested a suspect in his 40s in West Sussex.
- Estimated financial impact
- RTX 8-K (24 Sept 2025) said the incident was not expected to have a material financial impact.
- Attribution (as stated)
- No official attribution recorded
SOURCE REFERENCES
- [1] Ransomware attack behind widespread airport disruptions, EU agency saysComputing · computing.co.uk
- [2] RTX Form 8-K (Collins Aerospace cybersecurity incident)RTX Investor Relations · investors.rtx.com · 24 SEP 2025
- [3] Ransomware hack caused European airport delays, canceled flightsClaims Journal (AP) · claimsjournal.com · 22 SEP 2025
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.