Day of delays at Heathrow after cyber-attack brings disruption

Heathrow was among several European airports hit by delays on Saturday after a cyber-attack affecting an electronic check-in and baggage system.

The airport said a number of flights were delayed as a “technical issue” impacted software provided to several airlines.

Brussels Airport said a cyber-attack on Friday night meant passengers were being checked in and boarded manually, and Berlin’s Brandenburg Airport reported longer waiting times due to the problem.

RTX, which owns software provider Collins Aerospace, said it was “aware of a cyber-related disruption” to its system in “select airports” and that it was working to resolve the issue as quickly as possible.

The company added: “The impact is limited to electronic customer check-in and baggage drop and can be mitigated with manual check-in operations.”

It said its Muse software – which allows different airlines to use the same check-in desks and boarding gates at an airport, rather than requiring their own – had been affected.

The BBC understands that British Airways is operating as normal using a back-up system, but that most other airlines operating from Heathrow have been affected.

A National Cyber Security Centre spokesperson said: “We are working with Collins Aerospace and affected UK airports, alongside Department for Transport and law enforcement colleagues, to fully understand the impact of an incident.”

The European Commission, which has a role in managing airspace across Europe, said it was “closely monitoring the cyber attack”.

A spokesperson added there was no indication of a “widespread or severe” attack and that it was working with airlines and airports to “restore operations and support passengers”.

Hundreds of flights have been delayed at the airports throughout Saturday, according to flight tracker FlightAware.

Dublin Airport said it and Cork Airport had experienced a “minor impact” from the cyber-attack, with some airlines implementing manual check-in processes.

Lucy Spencer said she had been queuing to check in for a Malaysia Airlines flight for more than two hours, and that staff were manually tagging luggage and checking passengers in over the phone.

“They told us to use the boarding passes on our phone, but when we got to the gates they weren’t working – they’ve now sent us back to the check-in gate,” she told the BBC from Heathrow’s Terminal 4, adding that she could see hundreds of people queuing up.

Another passenger, Monazza Aslam, said she had been sitting on the tarmac for over an hour “with no idea when we will fly”, and had already missed her onward connection at Doha.

“I’ve been at Heathrow with my elderly parents since 05:00,” she said, adding: “We are hungry and tired.”

Johnny Lal, who was due to fly to Bombay for his mother-in-law’s funeral on Saturday, said he and his family will now miss their flight.

He told the BBC his mother “can’t walk one step without her [mobility] scooter” but that Heathrow staff had been unable to provide her with one. “They keep just telling us the systems are down.”

Luke Agger-Joynes said that, while queues in Terminal 3 were “much larger than normal”, the airline for his US flight and the airport “seem to be prepared and the queues are moving much faster than I feared”.

He added: “They are also calling out specific flights and picking people out of the queue to ensure they don’t miss their flights.”

Heathrow said additional staff were at hand in check-in areas to help minimise disruption.

“We advise passengers to check their flight status with their airline before travelling to the airport and arrive no earlier than three hours before a long haul flight or two hours for a domestic flight.”

Transport Secretary Heidi Alexander said she was aware of the incident and was “getting regular updates and monitoring the situation”.

EasyJet and Ryanair, which do not operate out of Heathrow but are among Europe’s biggest airlines, said they were operating as normal.

Brussels Airport said there would be a “large impact on the flight schedule”, including cancellations and delays.

Europe’s combined aviation safety organisation, Eurocontrol, said airline operators had been asked to cancel half their flight schedules to and from the airport between 04:00 GMT on Saturday and 02:00 on Monday due to the disruption.

In a separate incident, Dublin’s Airport 2 terminal has reopened following a security alert. Suspicious luggage was flagged to Gardaí (Irish police) on Saturday, who evacuated the terminal as a “precautionary measure”.

Travel journalist Simon Calder said that “any disruption is potentially serious” at Heathrow, given it is Europe’s busiest airport, and that “departure control is a really complex business”.

He told the BBC: “These things are all interconnected, so a little bit of a problem in Brussels, in Berlin… people start missing connections, planes and passengers and pilots are not where they are meant to be, and things can get quite a lot worse before they get better.”

It was only last July that a global IT crash due to a faulty software update from cybersecurity firm Crowdstrike caused disruption to aviation, grounding flights across the US.

Analysts said at the time that the incident highlighted how the industry could be vulnerable to issues with digital systems.

While there are unfounded accusations circulating that this cyber-attack was carried out by Kremlin-sponsored hackers, all major hacks in the past few years have been carried out by criminal gangs more interested in extracting money from their victims.

Extortion gangs have made hundreds of millions of dollars a year by stealing data or using ransomware to cause chaos and extract ransoms in bitcoin from their victims.

It is far too early to know who is behind this attack. Some cyber-security experts suggested this could be a ransomware attack, but note that these can be perpetrated by state-sponsored actors as well.

Collins Aerospace has yet to comment publicly about the nature or origin of the hack.

Many hacking gangs are headquartered in Russia or other former Soviet countries, some of which are thought to have ties to the Russian state.

But there have been plenty of arrests elsewhere, while British and American teenagers are accused of carrying out some recent large cyber-attacks against Las Vegas casinos, M&S, Co-op and Transport for London.

Liberal Democrats MP Calum Miller said the government must make a statement on whether they think the Kremlin is to blame.

He referred to Russian warplanes entering Estonian airspace on Friday, adding “the government needs to urgently establish if Vladimir Putin is now attacking our cyber systems”.