ENISA confirms ransomware behind chaos at airports

The European Union Agency for Cybersecurity, ENISA, has confirmed that the affected automated check-in systems at several European airports were disrupted by ransomware.

Since Friday, several airports in European countries, including Belgium, Germany, Ireland, and the United Kingdom, have been affected by cybercriminals.

The attackers successfully disrupted the automated check-in systems provided by Collins Aerospace, causing delays, cancellations, and long queues at the airports.

A spokesperson from RTX, Collins Aerospace’s parent company, stated that a “cyber-related disruption” had been identified in its Arinc cMUSE software at certain airports. This software allows airlines to share features like check-in desks and boarding gates, so they don’t have to manage all their own infrastructure.

“The impact is limited to electronic customer check-in and baggage drop and can be mitigated with manual check-in operations,” RTX said in a statement at the time.

The disruption at the European airports continued to keep people busy throughout the weekend and Monday.

On Monday, Collins Aerospace told Reuters that it was working with the affected airports, including Brussels and London Heathrow, Europe’s busiest airport, and was in the final stages of completing updates to help restore full functionality.

The European Union Agency for Cybersecurity, ENISA, told the BBC on Monday that ransomware had been used to scramble automatic check-in systems.

“The type of ransomware has been identified. Law enforcement is involved to investigate,” the agency said in a statement.

In an internal memo sent to Heathrow staff, seen by the BBC, Collins Aerospace says that more than a thousand computers may have been “corrupted,” and most of the work to bring them back online has to be done in person and not remotely.

According to the BBC, Collins Aerospace told employees in a separate memo not to turn off computers or log out of the check-in software if they were logged in.

As of writing, it remains unclear who is behind the attack.