Sector context

This is our description, not a regulatory classification. An airline, an airport and an air navigation provider each run safety, security and passenger-facing systems. Many of the passenger-facing ones are shared. Check-in, baggage and boarding platforms serve several airlines at one airport, and are often supplied by a third party that runs them on customer networks.

ENISA’s Threat Landscape 2026 (calendar 2025; mostly open-source incident data; EU scope) says transport accounted for 8% of recorded events and 8% of significant-impact events reported under NIS2 in 2025. By mode, the targeting shares were railway 31.9%, air 30.4%, road 17.9% and water 16.4%. Of the transport events, DDoS claims were 83.1% and unauthorized access 16.3%. ENISA names the September 2025 ransomware incident at Collins Aerospace, affecting passenger-processing software, as the most significant case. It says it disrupted automated check-in at several EU airports, including Brussels and Berlin, causing delays, cancellations and manual check-in.

The documented case: Collins Aerospace MUSE, September 2025

SourceWhat it says
RTX Form 8-K, event date 19 September 2025, signed 24 September 2025RTX became aware on 19 September of a product cybersecurity incident involving ransomware on systems supporting its Multi-User System Environment (MUSE) passenger-processing software, which lets airlines share check-in and gate resources, including baggage handling. The MUSE airport systems operate outside RTX’s enterprise network, on customer-specific networks. Customers moved to back-up or manual processes and had delays and cancellations. RTX stated the incident had not had, and was not reasonably expected to have, a material impact on its financial condition.
UK National Crime Agency, 24 September 2025A man in his forties was arrested in West Sussex on suspicion of Computer Misuse Act offenses and released on conditional bail. The NCA said the incident was reported on 19 September, affected flights at Heathrow and other European airports, and that the investigation was at an early stage.

Our reading: the case shows three things. A supplier’s product incident became an airport operations problem. The supplier’s own enterprise network was not the affected system. And the working recovery was manual, not technical. We found no official findings, charges or later update after 24 September 2025 on the NCA, NCSC or UK Government sites, and RTX’s later quarterly and annual reports (Q3 2025 to Q2 2026) do not mention the incident. ENISA’s 2026 landscape describes the incident as ransomware in one place and, in another table, as an Everest Group claim of unauthorized FTP access to the system. The entry method is therefore not established in the sources we hold, and we make no claim about it.

Five priorities

#PriorityEvidenceQuestion for the board
1Shared passenger and operations platformsCollins/MUSE: one supplier platform, several airportsWhich shared platforms can stop our operation, and who runs them?
2Availability under hacktivist pressureETL 2026: DDoS claims were 83.1% of transport eventsWhich public-facing services must stay up, and what is our DDoS plan?
3Tested manual fallbackCollins: customers shifted to back-up or manual processesCan we check in, board and load with no system for a defined period? When did we last try?
4Critical system identificationGCAA CAR VII Art. 4.9.1; GCAA guidelines 6.1; EU Part-ISDo we have a current list of critical ICT systems and data, with owners?
5Reporting under more than one regimeGCAA, EU Part-IS (72 hours)Do we know which clock starts when, for each authority?

Regulatory lens

InstrumentWhat we verifiedLimit
GCAA CAR Part VII, Edition 05 Revision 1 (published 25 Feb 2026, effective 16 Mar 2026)Art. 4.9.1 requires airport operators, aircraft operators, air traffic services providers and other relevant entities to identify their critical ICT systems and data used for civil aviation purposes and, according to a risk assessment, to develop and implement measures to protect them from unlawful interference. Art. 5.1.6 requires information on incidents of unlawful interference and preparatory acts to be reported in a practical and timely manner to the Competent Authority and others as defined in the National Civil Aviation Security ProgramThe text sets no hour limit. Edition status is from the GCAA e-publication and must be checked against the live site
GCAA National Civil Aviation Cybersecurity Guidelines, Version 1, September 2024The foreword calls them a set of principles, best practices and recommendations. Section 6.1 lists examples of critical systems: air navigation, departure control, flight information display, baggage handling and others. The reporting steps are an immediate call to the AVSEC hotline, a report within 48 hours through the ROSB system and the voluntary reporting systemWhether each step binds depends on how the Authority applies the document. Section 5.2.3 uses the word ‘shall’. We read the 48-hour step as a guideline requirement, not as CAR text
EU Part-IS: Delegated Regulation 2022/1645 and Implementing Regulation 2023/2032022/1645 applies from 16 October 2025 to design and production organizations and to aerodrome operators and apron management providers. 2023/203 applies from 22 February 2026 (1 January 2026 for the EGNOS provider) to the other organizations in scope, including air operators and air traffic service providers. Both require reporting to the competent authority as soon as possible and within 72 hours from when the condition became known, unless exceptional circumstances prevent itThe texts we read do not mention third countries. Scope is tied to organizations certified under EU rules, for example air operators under Part-ORO. Third-country operators fall under Part-TCO (Regulation 452/2014), which we read as carrying no information-security text. That a UAE air operator certificate holder is outside scope is our inference, not text. A UAE firm holding an EU approval would fall in the matching category. We could not retrieve EASA’s Part-IS FAQ

Our reading: a UAE operator with EU activity can face the GCAA’s ‘practical and timely’ duty, the 48-hour guideline step and a 72-hour EU clock at once. The three clocks start from different events. Write the trigger for each down before an incident.

Questions for the next planning cycle

  • List the shared platforms in your operation. For each: supplier, hosting model, network position, fallback and last fallback test.

  • If your largest supplier is hit by ransomware tomorrow, which operations stop and which continue by manual means?

  • Does your critical-system list match what GCAA Art. 4.9.1 asks for, and is it owned by someone in operations, not only IT?

  • What does your contract oblige a supplier to tell you, and how fast?

  • Which authorities do you report to, and have you tested the hand-off from incident team to regulator contact?

Beyond aviation: verified rules by mode

RuleWhat we verifiedStatus
TSA rail and transit security directives SD 1580-21-01E and SD 1582-21-01EIncident reporting is no later than 72 hours after the owner or operator identifies a cybersecurity incident. Effective 16 January 2026 to 15 January 2027. Earlier directives used 24 hoursRead in TSA directive text. Directives are renewed yearly: check the current one
TSA surface cyber rule (NPRM 89 FR 88488, 7 November 2024)Covers pipelines and rail, not aviation. Not final: the Unified Agenda lists the final rule as to be determinedStatus from the Federal Register and Unified Agenda
TSA aviationEmergency amendments to airport and aircraft operator security programs were issued on 7 March 2023. No aviation final rule exists. The amendment texts are not public, so we cannot state their contentPress release and court ruling read; renewal dates not found
US Coast Guard maritime cyber rule, 90 FR 6298Final rule published 17 January 2025, effective 16 July 2025. Cybersecurity officer, assessment and plan due 16 July 2027Whether a proposed delay for US-flag vessels was adopted is unverified
EU NIS2 Directive 2022/2555Annex I lists air, rail, water and road transport. Member States had to transpose by 17 October 2024National transposition status was not checked

One shipping case beyond aviation

A.P. Moller-Maersk’s Q2 2017 interim report says the NotPetya attack on 27 June 2017 was contained to the container-related businesses, six of nine businesses kept normal operations, it restored users and applications at 500 locations, and it estimated the impact at USD 200 to 300 million, mostly lost revenue in July. It is a transport example of recovery at scale. It is not an aviation case.

About the evidence

ENISA’s data is EU-wide and open-source. It says open sources do not give a complete picture. The Collins case rests on one company filing, one police statement and ENISA’s later summary. No official findings were found. GCAA edition and guideline status come from the GCAA website; the live site governs. TSA directives are renewed yearly. The priorities table is Cybrilliant analysis.

Sources

  1. ENISA Threat Landscape 2026, September 2026. Accessed 9 October 2026. enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202026_Final.pdf

  2. RTX Corporation, Form 8-K (event date 19 September 2025, signed 24 September 2025), SEC EDGAR. Accessed 9 October 2026. sec.gov/Archives/edgar/data/101829/000010182925000036/rtx-20250919.htm

  3. UK National Crime Agency, UK arrest following aerospace cyber incident, 24 September 2025. Accessed 9 October 2026. nationalcrimeagency.gov.uk/news/uk-arrest-following-aerospace-cyber-incident

  4. UAE GCAA, CAR Part VII Aviation Security, Edition 05 Revision 1 (published 25 February 2026). Accessed 9 October 2026. gcaa.gov.ae/en/epublication/EPublications/Civil%20Aviation%20Regulations%20(CARs)/CAR%20VII%20-%20AVIATION%20SECURITY%20REGULATIONS/CAR%20Part%20VII-Ed05-Rev1-Feb-2026-F.pdf gcaa.gov.ae

  5. UAE GCAA, National Civil Aviation Cybersecurity Guidelines, Version 1, September 2024. Accessed 9 October 2026. gcaa.gov.ae/en/epublication/PublishingImages/Pages/gcaa-cyber-security/GCAA%20National%20Civil%20Aviation%20Cybersecurity%20Guidelines%20Version%201%20Sept%202024.pdf

  6. Delegated Regulation (EU) 2022/1645 (Part-IS), EUR-Lex. Accessed 9 October 2026. eur-lex.europa.eu/legal-content/EN/TXT/ eur-lex.europa.eu

  7. Implementing Regulation (EU) 2023/203 (Part-IS), EUR-Lex. Accessed 9 October 2026. eur-lex.europa.eu/legal-content/EN/TXT/ eur-lex.europa.eu

  8. A.P. Moller-Maersk, Interim Report Q2 2017. Accessed 9 October 2026. investor.maersk.com/static-files/c95cbb9d-bc4d-4394-9664-67d5ba39e4e9

  9. TSA Security Directive 1580-21-01E (rail and transit), effective 16 January 2026. Accessed 9 October 2026. tsa.gov/sites/default/files/signed_security-directive-1580-21-01e-and-transmittal-memo_508c.pdf

  10. TSA, Enhancing Surface Cyber Risk Management, NPRM, 89 FR 88488, 7 November 2024. Accessed 9 October 2026. federalregister.gov/documents/2024/11/07/2024-24704/enhancing-surface-cyber-risk-management

  11. US Coast Guard, Cybersecurity in the Marine Transportation System, final rule, 90 FR 6298, 17 January 2025. Accessed 9 October 2026. federalregister.gov/documents/2025/01/17/2025-00708/cybersecurity-in-the-marine-transportation-system

How we label evidence

Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.

Part of the solutionSecure & ComplyTurn regulatory duties into controls that hold up.See how we work →

Related service

Third-Party & Supply-Chain Risk

Use this industry view to prioritize Aviation and Transportation cyber-risk decisions.

Talk to an ExpertSee this service →Related articles →
Also relevant:Cyber Resilience & RecoveryCrisis ManagementEmerging Technology SecurityAviation & Transportation