RTX subsidiary hit by major cyberattack

A major ransomware attack against Collins Aerospace — a subsidiary of Arlington County-based Fortune 500 aerospace and defense contractor RTX — disrupted check-in and boarding systems at several airports across Europe over the weekend, with disruptions continuing until Monday, forcing delays cancellations of flights.

The disruptions to electronic systems meant that only manual check-in and boarding was possible. Airports said the issue centered around a provider of check-in and boarding systems — not airlines or the airports themselves.

Collins Aerospace, whose systems help passengers check themselves in, print boarding passes and bag tags and dispatch their luggage from a kiosk, cited a “cyber-related disruption” to its MUSE (Multi-User System Environment) software at “select airports.” The New York Times reports that the Muse software is used by about 300 airlines at 100 airports.

According to the New York Times report, the European Union Agency for Cybersecurity said on Monday that the disruption had been caused by a ransomware attack. However, it is still unclear who was behind the attack. An organization spokesperson did not have more details.

Experts said it could turn out to be hackers, criminal organizations or state actors.

Fallout from the cyberattack has extended for days, as passengers faced dozens of canceled and delayed flights — and the impact poised to worsen for at least one major airport.

Starting late Friday, airports in Berlin, Brussels and London were hit by disruptions to electronic systems that snarled up check-in and sent airline staffers trying options like handwriting boarding passes or using backup laptops. Many other European airports were unaffected.

The European Commission, the executive branch of the 27-nation European Union, said that aviation safety and air traffic control were unaffected. There was currently no indication of a widespread or severe attack, while the origin of the incident remained under investigation, it added.

While departure boards for London’s Heathrow and Berlin’s Brandenburg airports were showing signs of smoother arrivals and departures on Sunday, Brussels Airport was still facing considerable issues.

The New York Times reported that Brussels Airport, seemingly the hardest hit, had at least 40 of 277 departing flights scheduled for Monday canceled in Brussels, as well as 23 of 277 arriving flights.

RTX did not immediately respond to requests for comment.

On Saturday, RTX said in a statement that it was working to resolve the issue: “The impact is limited to electronic customer check-in and baggage drop and can be mitigated with manual check-in operations.”

Brussels Airport said was able to maintain 85% of scheduled departures over the weekend thanks to the deployment of extra staff by airport partners “and the fact that self bag drop and online check-in are still operational.”

The cyberattack affected only computer systems at check-in desks, not self-service kiosks, airport spokesperson Ihsane Chioua Lekhli said, and teams were turning to alternative backup systems and pulling out laptop computers to help cope with the impact.

The airports advised passengers to check the status of their flights before traveling to the airports, and using alternative check-in methods.

A rolling message Sunday on the Brandenburg Airport’s web page said: “Due to a systems outage at a service provider, there are longer waiting times. Please use online check-in, self-service check-in and the fast bag drop service.”

RTX has more than 185,000 employees globally and reported more than $80.73 billion in 2024 sales. The contractor is Virginia’s second-highest ranked company by revenue on the 2025 Fortune 500.

Virginia Business Associate Editor Josh Janney contributed to this report.