Show menu

Europe airport cyberattack, Day 3: status and workarounds

Wide view of Heathrow check-in hall with active kiosks and short lines as Europe airport cyberattack recovery improves at major hubs.
by
6 min read

A ransomware attack against Collins Aerospace's MUSE passenger-processing software continues to snarl check-in and bag-drop at several major European hubs. On September 22, airports reported partial recovery and a shift back to normal in some terminals, but queues persisted at peak times, and cancellations lingered at harder-hit stations. ENISA confirmed ransomware as the cause, while Collins Aerospace said software updates are nearing completion. Here is what is working again, where lines remain, and how to minimize disruption at London Heathrow, Brussels, Berlin, and Dublin.

Key Points

  • Why it matters: Automated check-in and bag-drop outages ripple into delays, missed connections, and crew timeouts.
  • Travel impact: Brussels remains most constrained, Berlin faces hour-plus waits at times, Heathrow and Dublin see uneven but improving flows.
  • What's next: Collins Aerospace says restoration is in final stages, but manual workarounds will continue during peak bank departures.
  • Print mobile or paper boarding passes, arrive early, and use airline apps or kiosks to print bag tags where supported.
  • Recheck itineraries if connecting via Brussels or Berlin, and build extra buffer time for security and passport control.

Snapshot

Authorities confirmed a third-party ransomware attack on Collins Aerospace's MUSE system that underpins airline check-in, boarding, and some baggage workflows. As of September 22, Heathrow reported most flights operating with intermittent manual processing, Brussels canceled dozens of flights and urged schedule thinning, Berlin warned of significant queues amid marathon-weekend traffic, and Dublin said Terminal 1 was normal with manual workarounds still visible in Terminal 2. Law enforcement inquiries are active, and Collins says secure updates are nearly complete. Expect uneven recovery timing by terminal, carrier, and bank, especially where self-service units remain offline or partially restored.

Background

The outage began late September 19 and forced many airlines to pivot to manual check-in and handwriting or laptop-based issuance of documents. Unlike the July IT outage tied to endpoint software, this incident targets airline and airport passenger-processing, which is concentrated among a few vendors and is deeply integrated with DCS, BHS, and departure control kiosks. That concentration increases systemic risk when a single supplier is compromised. Regulators and national cyber agencies, including the U.K.'s NCSC, are coordinating with Collins and affected airports. Early operational mitigations relied on staffing surges, handheld devices, and selective flight cancellations to balance queuing and gate throughput. Recovery continues in waves as patched services are certified and brought back online.

Latest Developments

Europe airport cyberattack, airport-by-airport status

London Heathrow, United Kingdom. Heathrow reports the vast majority of flights operating, with some desks still using manual workarounds during peaks. Travelers who check in online and scan mobile passes at kiosks can often print bag tags once units are available, which shortens time spent in lines. Build extra time at Terminals with mixed operations and proceed directly to security if hand-luggage only.

Brussels Airport, Belgium. Brussels remains the most affected in Day 3 conditions. The airport canceled around 60 of roughly 550 Monday flights and continues to deploy iPads and laptops at check-in. Self Bag Drop is available for select Lufthansa Group carriers when systems are stable, but staffing directs flows dynamically. If you are connecting via Brussels on a tight layover, consider rebooking to a longer connection or an alternative hub.

Berlin Brandenburg, Germany. Berlin warns of longer queues at check-in and departure delays that can exceed an hour, compounded by post-marathon demand. Manual workarounds are active, and some kiosks resume in phases. Travelers with app check-in can often use Fast Bag Drop when printers are restored. Arrive early, and expect variability across airlines and terminals.

Dublin Airport, Ireland. Authorities say Terminal 1 is operating normally, while Terminal 2 shows intermittent manual processes for bag tags and boarding passes on impacted airlines. Aer Lingus and other carriers continue to lean on app check-in, with Express Bag Drop in use when kiosks are stable. Allow extra time if checking bags from T2.

Analysis

Three dynamics will shape the traveler experience over the next 24 to 48 hours. First, restoration will not be uniform. Even as Collins completes software updates, individual airlines and terminals will stagger their return to normal based on local validation and crew familiarity with interim procedures. This means two adjacent counters can perform very differently, so proactive queue choice and staff guidance matter. Second, airport-wide capacity is constrained most by bag-tag and bag-drop throughput rather than boarding pass issuance. Where kiosks can print tags after a mobile check-in scan, lines move materially faster. Airports that invested in modern self-service drop, like Brussels for Lufthansa Group and Ryanair's app-driven stations at Berlin, have more knobs to turn during partial outages. Third, schedule thinning is an efficient pressure valve, but it redistributes pain. Brussels' cancellations reduce peak queuing, yet they push travelers into retiming and reaccommodation. If you must connect through constrained hubs, choose longer layovers, avoid last flights of the day, and travel hand-luggage only when feasible. For most travelers at Heathrow and Dublin, conditions are improving, but morning and evening banks can still bottleneck. Monitor your airline app, and keep paper backups in case scanners bog down.

Final Thoughts

Expect a choppy return to normal as patched services roll out and staff unwind manual workarounds. Your best play is redundancy, online check-in plus printed backup, plus app-enabled tag printing at kiosks where live. If traveling through Brussels or Berlin, add buffer time or rebook to spread risk. Heathrow and Dublin look steadier, but peak banks remain variable. Keep notifications on, and verify departure terminals and counters before you leave for the airport. With ENISA confirming ransomware and Collins reporting final-stage updates, conditions should continue to improve, but prudent planning still pays during the Europe airport cyberattack.

Sources

Topics