British investigators arrested a man in his 40s at a West Sussex address on Tuesday as part of an inquiry into a cyber incident at Collins Aerospace that knocked baggage-handling and passenger check-in systems offline at Heathrow, Brussels, and Berlin airports, the National Crime Agency said, while a European Union cyber agency classified the disruption as ransomware-related and court records showed the suspect was released on bail pending further enquiries.
NCA operation in West Sussex
The NCA's cyber division executed the arrest alongside regional police, according to an agency statement that did not name the individual, consistent with UK practice before charge. Officers searched premises linked to the address; forensic teams seized digital devices for imaging. The man was taken to a police station for interview on suspicion of offenses under the Computer Misuse Act and related statutes, then released with bail conditions that typically include passport surrender and reporting requirements.
Collins Aerospace, a Raytheon subsidiary that supplies airport operations software, confirmed last week that a "cyber event" affected hosted services used by multiple carriers. The company hired external incident responders and said it was restoring systems in coordination with airport operators. None of the three hubs disclosed passenger counts delayed, but travelers posted overnight queues at check-in counters when bag tags could not print.
Airport disruptions
Heathrow, Europe's busiest hub, activated contingency plans that mixed manual bag sorting with delayed departures on peak business-travel days. Brussels Airport reported similar check-in slowdowns, and Berlin Brandenburg officials said self-service kiosks reverted to staff-assisted workflows while Collins backends recovered. Airlines shifted some flights to reduce checked luggage volume, a standard mitigation when baggage sortation software fails.
EU Agency for Cybersecurity briefings seen by reporters described ransomware as the likely mechanism, though the agency did not attribute the attack to a specific criminal brand. Ransomware against aviation suppliers has risen since 2023 as gangs target managed service providers with wide customer footprints.
Collins Aerospace's role
Collins provides departure-control and baggage messaging layers that sit between airline reservation systems and airport hardware. A compromise at the vendor level can cascade across continents because carriers share hosted instances. The firm said it found no evidence that aircraft safety systems were touched, distinguishing operational technology on the ramp from administrative networks handling passenger data.
Raytheon executives on an earnings call declined to quantify financial impact, citing the open law-enforcement probe. Insurers specializing in cyber policies watch the case to see whether airport business-interruption riders trigger for airlines that self-insure ground delays.
Investigation status
The NCA said the arrest was "significant" but warned that inquiries continue, language UK agencies use when multiple suspects may still be sought. Europol's European Cybercrime Centre has offered liaison support because Belgian and German infrastructure was affected. U.S. Transportation Security Administration officials monitored the outage but did not elevate domestic threat levels, treating the episode as a supplier incident rather than an aviation security breach.
For the security desk, the new fact is procedural: a named UK law-enforcement arrest tied to a ransomware-class outage at a major aerospace IT vendor, with three continental hubs recovering on backup playbooks while one suspect remains on bail.
Passenger and regulatory follow-through
UK aviation regulators asked airports to file service-continuity reports within 30 days, and the Civil Aviation Authority reminded carriers of EU261-style compensation rules when delays exceed statutory thresholds—though airlines often cite extraordinary circumstances for cyber events still under investigation.
Until charges are brought or dropped, the public record rests on the NCA's sparse statement, Collins's recovery bulletins, and the EU cyber agency's ransomware classification—a triangle investigators will have to align before any courtroom narrative emerges.