UK police arrest man over hack that affected European airports

A man in his 40s has been arrested in West Sussex in connection with a cyberattack on Collins Aerospace that disrupted check-in systems across multiple European airports, including Brussels, Berlin and Heathrow.

The National Crime Agency (NCA) said in a statement that the man, was arrested on Tuesday on suspicion of offences under the Computer Misuse Act and had since been released on conditional bail.

He has since been released on conditional bail as inquiries continue.

"Although this arrest is a positive step, the investigation into this incident is in its early stages and remains ongoing," NCA Deputy Director Paul Foster said.

He emphasised that cybercrime remains a persistent global threat, one that can ripple far beyond digital networks into real-world disruption. 

It remained unclear which criminal group was behind last week's hack. An NCA spokesperson declined to provide further details.

Ransomware gangs routinely publicise attacks and leak stolen data on dark web leak sites but websites that monitor those portals had not, as of Wednesday, detected any group claiming the hack.

Ransomware is malicious software used by cybercriminals to encrypt a company’s data and demand payment for its release.

They typically operate in the shadows, and many try to avoid targets which might earn them unwanted attention from law enforcement agencies according to experts.

The cyber incident first surfaced last Friday (19 September), when multiple European airports, including Brussels, Berlin, Dublin and parts of Heathrow, experienced widespread system outages.

Airlines using Collins’s 'MUSE' system were forced to resort to manual check-in and baggage handling procedures. 

Scores of flights were cancelled at Heathrow over the weekend, and delays were pervasive across the network.

Brussels stood out as the worst affected, with cancellations and long queues compounding the chaos. 

Berlin and Dublin continued to report delays as they worked to restore systems. 

Berlin airport said on Wednesday that it may take several more days before it had functional and secure software again, operator BER said in a statement.

Meanwhile, Britain's biggest carmaker Jaguar Land Rover, owned by India's Tata Motors, said on Tuesday it was extending the closure of its factories until 1 October following a hack this month that has left its operations paralysed and smaller suppliers struggling.

Copied