Fast Facts

• On September 20, 2025, a ransomware attack crippled London Heathrow, Brussels, and Berlin airports.
• The culprit: a strike on Collins Aerospace’s MUSE system, a central platform for check-in and baggage management.
• Up to 40% of Brussels flights were canceled; Heathrow saw over 90% of departures delayed.
• The attack spotlighted the danger of relying on a small number of critical IT suppliers.
• New EU rules (NIS2 Directive) demand stronger cybersecurity and supply chain oversight for essential services.

When the Digital Backbone Snaps

Imagine the world’s busiest airports reverting to handwritten tags and paper lists, as digital check-in screens blink to black and luggage piles up like stranded travelers. That’s exactly what unfolded across Europe in September 2025, when a coordinated ransomware attack struck the very heart of aviation’s digital nervous system.

The chaos didn’t stem from a single airport’s weak password or an unlucky employee’s click. Instead, hackers targeted Collins Aerospace - a major US-based supplier whose MUSE system quietly powers the check-in, gate, and baggage operations for dozens of airports and airlines. By striking this central node, criminals managed to paralyze multiple hubs at once, demonstrating just how brittle our interconnected supply chains have become.

The Hidden Danger of Digital Monocultures

The aviation sector’s push for efficiency has led to a handful of companies providing critical software for hundreds of airports. This “monoculture” is efficient - until it isn’t. The MUSE system, designed to help airlines share infrastructure and reduce costs, became a single point of failure. One successful breach rippled outward, grounding flights, trapping passengers, and costing millions in lost revenue and shattered trust.

ENISA, the EU’s cybersecurity agency, traced the attack to ransomware - a digital extortion scheme that locks up systems until a ransom is paid. While money is the usual motive, experts warn that state-backed actors could use these attacks to test Western defenses, sow chaos, or steal sensitive data under the radar.

Similar incidents have haunted other sectors: the 2021 Colonial Pipeline hack halted fuel deliveries across the US East Coast, and the 2017 NotPetya attack - originally aimed at Ukraine - spread globally, crippling shipping giant Maersk. In each case, a single supplier’s compromise cascaded into systemic disaster.

Europe’s Legal Wake-Up Call

In response, the European Union has toughened its stance. The original NIS Directive required essential service providers to manage cyber risks and report incidents, but inconsistencies left dangerous gaps. Now, the NIS2 Directive widens the net: more sectors (including transport, energy, and health) are covered, and company directors are personally accountable for digital safety - even in their supply chains.

Italy, like other EU nations, has ramped up its own laws to match. The National Cybersecurity Agency leads the charge, ensuring that companies can’t just tick boxes - they must overhaul contracts, train staff, and audit suppliers to harden every link in the chain.

From Emergency Patching to Proactive Defense

The lesson is clear: digital infrastructure is now as vital as runways and radar towers. Manual workarounds can’t keep planes flying. Redundant systems, real-time monitoring, and airtight supplier agreements are no longer optional. The age of “fix it when it breaks” is over - prevention and resilience must become the norm.

WIKICROOK

• Ransomware: Ransomware is malicious software that encrypts or locks data, demanding payment from victims to restore access to their files or systems.
• Supply Chain Attack: A supply chain attack is a cyberattack that compromises trusted software or hardware providers, spreading malware or vulnerabilities to many organizations at once.
• MUSE System: The MUSE System is a centralized platform used by airports and airlines for efficient check-in and gate management, but it also poses cybersecurity risks.
• NIS2 Directive: The NIS2 Directive is an EU law requiring critical sectors and their suppliers to strengthen cybersecurity and report serious cyber incidents.
• Redundancy: Redundancy means having backup systems ready to take over if the main system fails, ensuring continued operation and minimizing disruptions.