Airport chaos officially linked to ransomware attack – Tech Digest

The ongoing disruption at several of Europe’s busiest airports has been officially linked to a ransomware attack, according to the European Union Agency for Cybersecurity (ENISA). 

The malicious software was used by criminal gangs to hold automatic check-in and boarding systems to ransom. ENISA told the BBC that the type of ransomware had been identified and law enforcement was now involved in the investigation.

Evidence of a ransomware attack came from internal crisis communications seen by the BBC. An internal memo to Heathrow staff revealed that more than a thousand computers may have been “corrupted.”

It also described how Collins Aerospace, the US-based software provider that was the direct target of the attack, tried to rebuild its systems, only to discover the hackers were still inside.

This suggests a persistent and sophisticated attack aimed at maximum disruption to force a payout. The criminals behind such attacks often demand ransoms in cryptocurrency such as bitcoin.

There is still no clear timeline for when normal services will resume. While the software provider stated on Monday morning that it was in the “final stages of completing necessary software updates,” internal communications reveal that much of the recovery work has to be done in person, not remotely.

Although disruption has eased at Heathrow and Berlin, Brussels Airport was still asking airlines to cancel nearly 140 flights on Monday.

The aviation industry is becoming an increasingly attractive target for cyber criminals, with attacks rising 600% in the last year alone, according to a recent report. The sector’s reliance on complex, interconnected, and often outdated digital systems presents a significant vulnerability.

An attack on a single provider like Collins Aerospace, whose Muse software is used by multiple airlines across different airports, can have a domino effect.

The high-value nature of the industry and the severe disruption a successful attack can cause also make it a lucrative target for criminals seeking large ransom payments.