The UK National Crime Agency (NCA) has arrested a suspect in a ransomware attack that disrupted operations at European airports earlier this week.
At the end of last week, hackers attacked Collins Aerospace, whose self-service kiosks (ARINC SelfServ vMUSE) passengers used for check-in, baggage drop, and printing boarding passes for their flights. The American company reported a “cyberattack-related outage” that caused software issues at “certain airports in Europe.”
As a result, beginning on Friday, September 19, 2025, many airports in Berlin, Brussels, and London experienced disruptions to electronic systems that paralyzed check-in and forced airline staff to seek alternatives (for example, filling out boarding passes by hand or using additional laptops). The extent of the impact varied, as it depended on how many vMUSE devices were installed at a given airport.
For example, Brussels Airport, which was hit the hardest, reported that it asked airlines to cancel about 140 flights scheduled for Monday, September 22, because the American software vendor affected by the attack “cannot provide a new secure version of the check-in system.” The airport said that 25 flights were canceled on Saturday and another 50 on Sunday.
Although the affected company did not share details of the incident, cybersecurity expert Kevin Beaumont reported that the attackers used an “incredibly primitive” ransomware called HardBit in the attack.
In turn, the publication Bleeping Computer was unable to confirm these findings and, citing its own sources, reported that the Loki ransomware may have been involved in the attack.
According to the NCA, the arrest was made as part of an investigation into the cyberattack on Collins Aerospace and its parent company, RTX Corporation. In West Sussex, a 40-year-old man, whose name has not been disclosed, was detained on suspicion of offenses under the Computer Misuse Act. The suspect has since been released on bail.
“Although this arrest is an important step, the investigation of the incident is still in its early stages and ongoing,” law enforcement officials added.