# Collins Aerospace MUSE ransomware knocks out check-in at Heathrow, Brussels and Berlin · pwn.watch

> Ransomware hit RTX's Collins Aerospace MUSE passenger-processing software on September 19, 2025, breaking electronic check-in, bag drop and boarding at several European airports. Airports fell back to manual check-in and handwritten boarding passes; Brussels was still disrupted days later. ENISA confirmed it was ransomware.

Page: https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025 · generated 2026-10-23T03:14:13.676Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Collins Aerospace MUSE (airport check-in and boarding)
- Started: 2025-09-19 · closed: 2025-09-24
- Affected: n/a

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025/feed.xml
- JSON Feed: https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025.json
- This file: https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025/llms.txt

## Updates (newest first)
- 2025-09-24: Collins works on restoring software for affected airlines (https://www.reuters.com/business/aerospace-defense/collins-aerospace-working-restoring-software-airlines-hit-by-cyber-attack-2025-09-24/)
- 2025-09-22: ENISA confirms third-party ransomware behind the disruption (https://www.reuters.com/business/aerospace-defense/eu-agency-says-third-party-ransomware-behind-airport-disruptions-2025-09-22/)
- 2025-09-20: Disruption expected to stretch into Sunday; Brussels cancels flights (https://www.reuters.com/en/cyberattack-causes-flight-delays-cancellations-brussels-airport-2025-09-20/)
- 2025-09-19: MUSE outage begins; Heathrow, Brussels and Berlin switch to manual check-in (https://www.npr.org/2025/09/20/g-s1-89727/cyberattack-european-airports)

## Fix brief
# Security brief: Collins Aerospace MUSE ransomware knocks out check-in at Heathrow, Brussels and Berlin

Source: https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025 · status: closed (closed Sep 24, 2025) · severity: high · updated Sep 24, 2025

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
Ransomware hit RTX's Collins Aerospace MUSE passenger-processing software on September 19, 2025, breaking electronic check-in, bag drop and boarding at several European airports. Airports fell back to manual check-in and handwritten boarding passes; Brussels was still disrupted days later. ENISA confirmed it was ransomware.

Severity detail: Ransomware on a shared airport vendor; multi-day disruption

- Product: Collins Aerospace MUSE (airport check-in and boarding)

## Affected versions
- n/a

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Latest updates
- Sep 24, 2025: Collins works on restoring software for affected airlines
- Sep 22, 2025: ENISA confirms third-party ransomware behind the disruption
- Sep 20, 2025: Disruption expected to stretch into Sunday; Brussels cancels flights
- Sep 19, 2025: MUSE outage begins; Heathrow, Brussels and Berlin switch to manual check-in

## Write-ups & news
- [EU agency confirms ransomware attack behind airport disruptions](https://www.reuters.com/business/aerospace-defense/eu-agency-says-third-party-ransomware-behind-airport-disruptions-2025-09-22/)
- [RTX confirms hack of passenger boarding software involved ransomware](https://www.cybersecuritydive.com/news/rtx-hack-passenger-boarding-software-ransomware/761265/)
- [Cyberattack disrupts check-in systems at major European airports](https://www.npr.org/2025/09/20/g-s1-89727/cyberattack-european-airports)
- [Collins Aerospace working on restoring software for airlines hit by cyberattack](https://www.reuters.com/business/aerospace-defense/collins-aerospace-working-restoring-software-airlines-hit-by-cyber-attack-2025-09-24/)

## Caveats
closedAt approximates recovery; some airports ran degraded longer.

---
Machine-readable: https://pwn.watch/i/collins-aerospace-muse-ransomware-airports-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.