Man Arrested After Cyberattack Disrupts Flights at European Airports

A man was arrested in England on Sept. 23 by the UK’s National Crime Agency (NCA) on suspicion of involvement in a cyberattack that disrupted flights at European airports for several days.

Flights at London’s Heathrow and several other European airports were disrupted by the incident, which impacted Collins Aerospace, a U.S. company that provides check-in and passenger processing systems.

The NCA said in an email sent to The Epoch Times that its officers, supported by the South East Regional Organised Crime Unit, arrested a man in his 40s in West Sussex on suspicion of offenses under the Computer Misuse Act. He has been released on conditional bail.

The cyberattack affected check-in and boarding systems over the weekend at several major international hubs, including Brussels, Berlin Brandenburg, and London Heathrow.

Flights were canceled or delayed as the impacted airlines carried out check-in and boarding operations manually.

The disruption began on Sept. 19 and lasted into Sept. 22, before Collins Aerospace—which is owned by the RTX Corporation—was able to fix its systems.

Brussels Airport was the hardest hit with almost 140 outbound flights on Sept. 22—about half of the 276 flights that were scheduled to depart that day—being canceled.

Investigation Ongoing

The head of the NCA’s national cybercrime unit, Deputy Director Paul Foster, said in the emailed statement that the investigation into the incident is in its “early stages and remains ongoing.”

“Cybercrime is a persistent global threat that continues to cause significant disruption to the UK,” Foster said. “Alongside our partners here and overseas, the NCA is committed to reducing that threat in order to protect the British public.”

Collins Aerospace says on its website that its passenger processing “allows multiple airlines to share check-in desks and boarding gate positions at an airport rather than having their own dedicated infrastructure.”

There had been speculation that Russia might have been responsible for the incident, following increased concern over aviation safety in Europe after recent incursions into Polish airspace.

Most recent hacks, including one involving British retailer M&S in April, have been ransomware attacks from criminal gangs looking to extort large sums of money from major corporations.

Last week, two British men were charged after being arrested by the NCA in connection with a major cyberattack carried out in August 2024 on the Transport for London (TfL) network.

One of them has also been charged with conspiring with others to infiltrate and damage the networks of SSM Health Care Corporation and Sutter Health, both based in the United States.

The NCA said it believed the TfL attack was carried out by members of the cyber-criminal group known as Scattered Spider, a network said to be made up primarily of individuals from the UK and the United States.

RTX, who own Collins Aerospace, said in an email to The Epoch Times, “We understand the United Kingdom National Crime Agency has made an arrest and appreciate their ongoing assistance in this matter.”