European Airport Disruptions Caused by Ransomware Attack

"The cybersecurity incident impacting Collins Aerospace, which led to disruptions at several major airports across Europe, was the result of a ransomware attack, according to the EU cybersecurity agency ENISA. ENISA said the type of ransomware involved in the attack has been identified and law enforcement is conducting an investigation, but the agency did not share further information. The cyberattack hit services provided by US-based Collins Aerospace, which is owned by RTX (formerly Raytheon)."

"Collins Aerospace is one of the world's largest suppliers of aerospace and defense solutions. The company was recently awarded a NATO contract for electromagnetic warfare solutions. Collins technology is used at airports to enable passengers to check in, print boarding passes and luggage tags, and dispatch their bags. The cyberattack has impacted check-in and boarding systems at major airports, forcing them to turn to manual processes. This resulted in delays and flights being cancelled."

ENISA identified the cybersecurity incident affecting Collins Aerospace as a ransomware attack and said the ransomware type has been identified while law enforcement conducts an investigation; ENISA did not share further details. The attack targeted services run by US-based Collins Aerospace, owned by RTX, a major aerospace and defense supplier recently awarded a NATO electromagnetic warfare contract. Collins systems used for passenger check-in, boarding-pass and luggage-tag printing, and baggage dispatch were affected, forcing airports to revert to manual processes and causing delays and cancellations. The incident disrupted airports in the UK, Germany, Belgium, and Ireland, including Heathrow, Brussels Airport, and Berlin Brandenburg. The UK's National Cyber Security Centre and the Department for Transport are investigating. An internal Heathrow memo reported over a thousand corrupted computers and that hackers remained inside Collins' network after systems were rebuilt and relaunched.

Read at SecurityWeek