UK Arrest Over Ransomware Attack That Disrupted European Airports

The UK authorities took a man into custody accused of participating in a cyberattack that caused disruptions at Heathrow Airport and three other major European airports.

The National Crime Agency (NCA) confirmed that a man in his forties was arrested in West Sussex on suspicion of offences under the Computer Misuse Act. He has since been released on bail while the investigation continues.

The Incident began last Friday when the baggage and check-in software from US company Collins Aerospace failed. As a response the airlines adìnd airports had to rely on manual systems, resulting in numerous flight delays and cancellations. Heathrow even deployed extra staff to terminals to help passengers as boarding passes had to be written by hand, as noted by the BBC.

The NCA’s deputy director Paul Foster described the arrest as “a positive step” but warned, “the investigation into this incident is in its early stages and remains ongoing”.

According to an internal Heathrow memo, engineers at Collins Aerospace tried to restart services on Monday, but eventually had to rebuild the affected systems from scratch, as noted by Cyberpress.

The company’s parent, RTX Corporation, confirmed in a notice to US regulators that ransomware was behind the disruption, though it did not specify which group was responsible, as reported by TechCrunch.

The European Union Agency for Cybersecurity (ENISA) also confirmed ransomware was used in the attack, which encrypted critical files and demanded payment in cryptocurrency, as reported by Reuters.

Such attacks are becoming more common: a report from French aerospace company Thales shows cyberattacks on aviation have risen by 600% in the past year, noted the BBC.

While Collins Aerospace has not given a timeline for recovery, it has advised airlines and ground handlers to continue using manual workarounds for at least another week.