On September 20, 2025, a cyberattack on a third-party provider’s systems disrupted operations at several major European airports, including London Heathrow, Berlin Brandenburg, and Brussels, among others.
The attack compromised MUSE, software owned by Collins Aerospace that supports electronic check-in, baggage drop, and boarding operations.
The result was widespread delays, cancellations, long lines, and frustrated passengers. This is a sharp reminder that modern aviation depends heavily on linked digital systems and the vendors who provide them.
What can we learn from this incident about the supply chain risks of critical infrastructure?
What Happened
The disruption began when MUSE software, widely used across European airports, was compromised. Although Collins Aerospace initially described the incident as a "cyber-related disruption", it was later discovered to be a ransomware attack. The identity of the cybercriminal group responsible remains unknown at time of writing.
Almost immediately, check-in counters, baggage drop services, and boarding systems failed. Busy airports such as Heathrow, Berlin, and Brussels, were hit hardest, forcing staff to switch to manual procedures, which inevitably slowed down operations and triggered long lines. In Brussels, flights were cancelled outright, while other hubs managed only partial recovery by the following day.
Passengers quickly expressed frustration not only at the delays but also at the lack of clear communication during the incident. Airlines and airports emphasized that, although the disruption was severe, core flight operations, such as air traffic control, were never at risk and that contingency plans were implemented to keep planes flying.
Nevertheless, the incident clearly demonstrated how centralized service providers can become single points of failure in a supply chain, especially with regard to critical infrastructure.
The timing of the incident and the choice of victim are also not random: small strategic suppliers are targeted and weekends are chosen to carry out malicious operations in order to maximize the effects.
Lessons Learned
This episode underscores several urgent lessons for organizations that rely on complex supply chains:
- Third-party risk is critical: In this case, the airports themselves were not the direct targets, but the vulnerability of the supplier caused a significant outage, complicating and in some cases even cancelling flight operations.
- Centralization multiplies risk: A single compromised system can, as in this case, affect multiple countries and facilities simultaneously.
- Contingency planning matters: Even the best cybersecurity strategy isn't foolproof. It is therefore necessary to be prepared to manage even the worst-case scenario and have contingency plans in place. In the case of the incident we're discussing, manual procedures, although imperfect, proved essential to keeping operations running.
- Communication builds resilience: It is crucial to provide clear and timely information to passengers and stakeholders about what is happening so that they can manage the disruption and mitigating at the same time the reputational impact.
- Regulatory oversight is needed: Stricter standards for supplier resilience and supply chain cybersecurity are essential to protect critical services. This is exactly the direction of NIS2.
Conclusion
This incident should lead not only to the necessity of stronger and more effective defences, that include the supply chain, but also inspire new ideas.
Future resilience depends on diversifying digital ecosystems rather than relying on single providers, encouraging cross-border collaboration that anticipates, not just reacts to, attacks, and incorporating predictive intelligence into supply chain monitoring.
The goal is no longer just to deal with the disruption, but to design systems that can adapt and learn from it in real time.
Stay Cyber Safe!
