Ransomware targeting third-party system software has caused widespread flight delays, cancellations, and forced manual check-ins at key European airports.

The recent cyberattacks that disrupted major European airports between 19 September and 21 September 2025 have exposed significant vulnerabilities in the aviation sector’s reliance on digital infrastructure.

The incident involving the website of Russia’s busy Pulkovo Airport in St. Petersburg involved hackers compromised the public-facing site, but no critical systems such as air traffic control had been affected. Instead, passengers looking for flight times or booking information on the website had been faced with error messages.

Two days later, a far broader and more impactful ransomware attack had targeted the automated check-in and boarding systems of Collins Aerospace, a key third-party software provider, causing widespread operational disruption across several of Europe’s busiest hubs including London Heathrow, Berlin Brandenburg, and Brussels airports.

These attacks had forced airports to revert to manual check-ins, greatly slowing passenger processing and resulting in numerous flight delays and cancellations.

According to CBS News, a travel analyst was quoted as being “surprised and shocked” at established aviation and defense firms had been vulnerable to the attacks, given that their systems are supposed to be highly resilient.

An official from ENISA (European Union Agency for Cybersecurity) has noted that “the disruptions resulted from ransomware that affected a third-party provider of the automated check-in and boarding systems. Law enforcement is involved in the ongoing investigation.”

Although details about the exact attack methodology and fallout are still scarce, Darren Guccione, CEO and co-founder, Keeper Security, has surmised: “Organizations that rely on third-party systems and vendors need to ensure that every point of access is secured, every connection is monitored and no user or system is automatically trusted.”

Another commentator, Ted Cowell, Head of Cybersecurity, S-RM, had been quoted as saying that these attacks do not always rely on exploiting technical or software vulnerabilities, but may often be “highly persuasive social engineering campaigns that weaponize publicly available information to impersonate internal staff.”

As investigations continue, affected airports are working to restore full functionality amid lingering impacts on travelers.