European airports grapple with cyberattack that disrupted check-in systems across major hubs

European airports continued to reel from a cyberattack over the weekend that disrupted the Muse software used for automated check-in and boarding, forcing some airports to revert to manual processing and resulting in hundreds of flight cancellations and delays.

Brussels Airport canceled nearly half of its outbound departures on Monday, scrapping about 140 of its 276 scheduled flights as it and partners worked to resolve the issue. The airport said the service provider was actively addressing the problem but offered no firm timeline for a full fix. Travelers were urged to check flight status with their airline before heading to the terminal.

Berlin and Dublin airports remained in disruption mode, with travelers warned to expect significant delays as operations continued to be impacted and ground handling moved to manual processes. Holy traffic was already high in the region as airports coped with the weekend fallout and, in some cases, returning travelers from events such as marathons.

The disruption centers on Muse, a multi-user system used by airlines for electronic check-in and baggage handling, operated by Collins Aerospace, a U.S.-based unit of RTX. Collins Aerospace said it was actively updating software and that the impact was limited to electronic check-in and baggage drop, with manual check-in options available to mitigate delays. Across affected hubs, airlines and airports have been directing passengers to use online check-in where possible and to arrive prepared for longer wait times at security and bag drop.

In Berlin, some airlines were still boarding passengers manually and there was no clear indication of how long the outage would persist. Passengers queued for bag drop and boarding passes in some terminals as the network struggled to return to normal operations. Dublin Airport reported 13 flight cancellations by midday Sunday, and while Terminal 1 was operating more normally on Monday, Terminal 2 continued to rely on manual workflows to tag bags and issue boarding passes, contributing to delays.

Image: Passengers queue at an airport during disruption

Heathrow, Britain's busiest airport, faced a rough weekend with at least 12 flights canceled and more than 400 delayed. By Monday, officials said the majority of flights were operating normally, but check-in and boarding for some services could take longer than usual. Passengers were urged to monitor flight status and arrive in line with airline guidance, typically two hours for short-haul and three hours for long-haul departures.

An aviation data analysis by Cirium on Monday found that delays at Heathrow were low and decreasing, Berlin reported moderate and decreasing delays, and Brussels showed excessive delays that were also decreasing. The National Cyber Security Centre in the United Kingdom said it was coordinating with Collins Aerospace, affected airports, the Department for Transport, and law enforcement to obtain a full understanding of the attack’s impact. The European Commission said it was monitoring the situation but found no signs the incident was widespread or severe.

Security and intelligence officials noted the attack follows a broader pattern of cyber intrusions that have affected other sectors. Some experts argued that the incident bore the hallmarks of Russian-linked activity, given the timing and the sophistication of the disruption, though investigators cautioned that attribution could take time and requires corroborating evidence. The National Cyber Security Centre, which is the public-facing arm of the U.K.’s intelligence community, has not publicly assigned blame, but it continues to investigate alongside international partners.

Muse software and its associated systems are widely used by airlines globally to automate check-in and boarding processes. The outage underscored how a single point of failure in a critical IT backbone can ripple through major hubs, affecting schedules, passenger flows, and the broader travel ecosystem. Airlines and airports have stressed the importance of contingency planning and maintaining manual alternatives to minimize disruption during such events.

Travelers are advised to monitor airline and airport advisories for real-time updates and to allow extra time for check-in, baggage handling, and security in the days ahead as operations normalize and workloads shift. Authorities say they will continue to provide updates as the investigation unfolds and as carriers implement their recovery plans.