Ransomware Hits Heathrow, Berlin as UK Arrests Suspect

• UK’s National Crime Agency arrests a man linked to a major ransomware attack on European airports.
• The cyberattack caused widespread disruptions, forcing critical airport systems into manual operation.

On September 24, 2025, the UK's National Crime Agency (NCA) arrested a man in his forties in West Sussex in connection with a ransomware attack that disrupted major European airports. The suspect was detained on suspicion of offenses under the Computer Misuse Act and later released on conditional bail, according to the NCA. Paul Foster, head of the NCA's National Cyber Crime Unit, emphasized that the investigation remains in its early stages despite this breakthrough.

The ransomware attack, confirmed by the EU’s cybersecurity agency, targeted Collins Aerospace's MUSE passenger processing software, which handles check-in, bag-drop, and boarding operations. The breach forced these systems to revert to manual processes, triggering significant operational delays.

Airports impacted by the attack include London Heathrow, Berlin, and Brussels. Flight delays, cancellations, and inefficiencies in passenger processing created widespread disruptions. Brussels Airport, in particular, requested airlines cancel a large number of flights on Monday, while recovery efforts at other affected locations continue.

Authorities are still piecing together the full scope of the attack, reinforcing the importance of global cybersecurity measures to safeguard critical infrastructure.