Heathrow Airport Cyberattack: What Happened, Who’s Affected, and What CISOs Should Know

According to Heathrow Airport, on the night of Friday 19 September 2025 a cyberattack targeted Collins Aerospace’s Muse software, a cloud-based platform used for electronic check-ins and boarding, rendering check-in systems offline at several major airports including Heathrow, Brussels and Berlin.

The disruption disrupted passenger processing, baggage handling and self-service kiosks, forcing airlines to run manual check-in procedures and resulting in long queues and stranded passengers; by 21 September the disruption had entered a second day, with delays under 45 minutes and 12 cancellations reported at Heathrow. The primary impact was concentrated at Heathrow, Brussels and Berlin, with 29 total cancellations across those airports by midday 20 September and no confirmed spread to other airports.

The root cause is described as a third-party vulnerability within Collins Aerospace’s Muse software, and the incident is described as ransomware-style in nature, though exploit details remain unclear. There is no confirmed threat actor, though suspicions have centred on Russian state-sponsored hackers, with some NATO-linked commentary noting the attack’s timing after a defense deal with NATO.

Collins Aerospace issued a brief statement confirming the disruption and its intent to restore full functionality, while government bodies and ENISA were coordinating responses as the investigation continued.