Airport cyberattack chaos highlights surge in high-profile ransomware threats

Cybercriminals are increasingly targeting high-profile organizations to secure larger ransoms and boost their reputations within hacking communities, cybersecurity experts said, after a ransomware attack crippled airport check-in systems across Europe, including Brussels, stranding thousands of passengers.

The European Union’s cybersecurity agency, ENISA, confirmed on Monday that the attack targeted Collins Aerospace, a subsidiary of RTX, disrupting check-in and baggage services since Friday and affecting dozens of flights at major hubs like Brussels Zaventem, Amsterdam Schiphol, and others.

Rafe Pilling, Director of Threat Intelligence at Sophos, a UK-based cybersecurity firm, said, “Most ransomware attacks focus on data encryption and theft for extortion, but a growing subset, often by Western-based groups, are designed for maximum disruption, targeting critical infrastructure like airports to gain greater visibility and impact.”

No group has claimed responsibility for the Collins Aerospace hack, according to dark web monitoring sites as of Monday. Ransomware involves malicious software that encrypts a company’s data, with cybercriminals demanding payment for its release. While many hackers avoid high-profile targets to evade law enforcement scrutiny, some are growing bolder, experts note.

In April 2025, the hacker group Scattered Spider was linked to a cyberattack that disrupted online operations at British retailer Marks & Spencer for weeks. On 19 September Britain’s National Crime Agency charged two teenagers in connection with a 2024 cyberattack on Transport for London, attributed to Scattered Spider, which caused significant disruption and millions in losses.

The FBI estimates Scattered Spider has conducted around 120 network intrusions, amassing approximately $115 million in ransom payments.

Martyn Thomas, Emeritus Professor of IT at Gresham College, London, warned, “The rising frequency and impact of cyberattacks, such as the recent airport disruptions, signal a rapidly escalating threat. Software developers must prioritize secure coding, and companies need to rigorously assess the security of their software to prevent catastrophic breaches in critical sectors like aviation.”

The Brussels Zaventem Airport, among others, faced severe disruptions from the Collins Aerospace hack, with check-in systems offline for hours on Friday, leading to over 30 flight delays and cancellations, compounding passenger frustration. Ripple effects persisted as of Tuesday.

Cybersecurity experts suggest that the pursuit of notoriety among cybercriminals is driving the trend toward high-profile targets.

“A small but skilled group of largely Western-based hackers are refining their tactics, emboldened by past successes,” Pilling said. “High-impact breaches not only yield financial rewards but also confer significant credibility within their underground networks.”

Thomas added, “So far, cybercriminals have primarily sought disruption or profit. If their motives shift toward causing mass harm, the same tactics could target critical systems in healthcare, energy, or aviation infrastructure, with devastating consequences.”

With Reuters, edited by g.g.

Caption: A ‘Temporarily Unavailable’ message is seen on a computer screen as airport staff handle check-ins manually at Brussels Airport, where dozens of flights were canceled following a cyberattack affecting multiple airports in Europe, in Brussels, Belgium, 22 September 2025. Several European airports were hit by a cyberattack on 20 September, which affected electronic check-in and baggage systems, causing delays and cancellations of flights. 40 out of 277 outbound flights and 23 out of 277 incoming flights have been cancelled, said Brussels Airport spokesperson Ihsane Chioua Lekhli. EPA/OLIVIER MATTHYS