FILE PHOTO: Travellers queue to check in at Heathrow Airport Terminal 4, following a disruption to check-in and boarding systems caused by a cyberattack which has affected several major European airports, resulting in flight delays and cancellations, in Greater London, Britain, September 20, 2025. REUTERS/Isabel Infantes/File Photo
LONDON (Reuters) -British police said on Wednesday a man had been arrested as part of an investigation into a ransomware attack against Collins Aerospace, owned by RTX, which knocked check-in systems at airports offline and caused widespread travel disruption across Europe.
The National Crime Agency said in a statement that the man, in his 40s, was arrested on Tuesday on suspicion of offences under the Computer Misuse Act and had since been released on conditional bail.
"Although this arrest is a positive step, the investigation into this incident is in its early stages and remains ongoing," NCA Deputy Director Paul Foster said.
It remained unclear which criminal group was behind last week's hack. An NCA spokesperson declined to provide further details.
Ransomware gangs routinely publicise attacks and leak stolen data on dark web "leak sites" but websites that monitor those portals had not, as of Wednesday, detected any group claiming the hack.
Ransomware is malicious software used by cybercriminals to encrypt a company’s data and demand payment for its release.
They typically operate in the shadows, and many try to avoid targets which might earn them unwanted attention from law enforcement agencies.
The attack on Collins Aerospace was the latest in a string of online hacks in Europe which have had significant offline consequences.
Britain's biggest carmaker Jaguar Land Rover, owned by India's Tata Motors, said on Tuesday it was extending the closure of its factories until October 1 following a hack this month that has left its operations paralysed and smaller suppliers struggling.
Berlin airport, one of several airports across Europe to have been impacted by the Collins Aerospace hack, said on Wednesday that it may take several more days before it had functional and secure software again, operator BER said in a statement.
(Reporting by James Pearson and Muvija MWriting by Catarina Demony,Editing by Michael Holden and Ed Osmond)
