European airports facing disruptions after cyberattack targets check-in systems

Passengers are seen in front of the check-in counters in Terminal 1 at Berlin Brandenburg Airport in Sch'nefeld, Germany after a widespread cyberattack on European airports, on Monday, Sept. 22, 2025. (Michael Ukas/dpa via AP)

BERLIN -- Several of Europe’s biggest airports still faced disruptions on Monday after hackers knocked out automatic check-in systems provided by Collins Aerospace, owned by RTX, affecting dozens of flights and thousands of passengers since Friday.

The disruptions were caused by a cyberattack, the EU’s cybersecurity agency confirmed on Monday, highlighting the growing risks of such attacks to critical infrastructure and industries.

Law enforcement was involved to investigate, the agency ENISA said in a statement, without providing details on where the cyberattack originated from.

Governments and companies have been the targets of cyberattacks in recent months, including luxury carmaker Jaguar Land Rover, which had to pause production as a result.

Collins said on Monday that it was working with the affected airports, including Brussels and London Heathrow, Europe’s busiest airport, and was in the final stages of completing updates to help restore full functionality.

Berlin airport, which was facing higher passenger numbers than usual on Monday due to the Berlin Marathon, still did not have its check-in systems restored and reported delays of over an hour for departures.

One passenger described the boarding process as akin to the early decades of commercial air travel, with handwritten boarding passes.

Brussels Airport was using iPads and laptops to check passengers in online. Of roughly 550 departing and arriving flights, 60 had to be canceled on Monday, it said.

Dublin Airport was experiencing “minimal impact” and had some manual processes in place.

A survey of some 1,000 companies by German industry group Bitkom found that ransomware - malicious software that locks up data until the victim pays to have access restored - was the most common form of cyberattack, with one in seven companies having paid a ransom.

Reporting by Chrisoph Steitz in Frankfurt, Klaus Lauer and Sabine Siebold in Berlin, Bart Meijer in Brussels, Conor Humphries in Dublin, Writing by Miranda Murray, Editing by Rachel More and Bernadette Baum, Reuters