How a Collins Aerospace cyber hit left EU airports scrambling—and what RTX must fix next

RTX Corporation (NYSE: RTX) confirmed that its Collins Aerospace unit has moved to resolve a cyber-related disruption in its MUSE airport check-in and baggage software after widespread delays and cancellations at major European hubs. The incident, which surfaced late Friday into Saturday, initially affected automated check-in systems and baggage services at London Heathrow, Brussels, and Berlin Brandenburg. With kiosks and baggage drop systems offline, airports were forced into temporary manual operations before systems were gradually stabilised through the weekend. Regulators and airport operators emphasised that flight safety was never compromised, and by early Sunday, updates indicated improving operations even as investigation and remediation continued.

Passengers across Europe reported long queues at check-in and boarding gates, with the heaviest disruption in Brussels, where airport authorities urged a reduced departure schedule to manage congestion. Heathrow and Berlin experienced delays and some cancellations but restored most functions more quickly. Industry trackers noted that delays began easing by Sunday morning as Collins Aerospace engineers brought MUSE systems back online in stages.

What exactly failed inside Collins Aerospace’s MUSE airport platform, and why did a software outage ripple so widely across European hub operations?

At the heart of the disruption was MUSE, short for Multi-User System Environment, the Collins Aerospace platform that powers common-use check-in desks, kiosks, boarding gates, and baggage drop services. When the platform was degraded, electronic check-in and automated baggage systems stopped functioning. That forced airports to revert to manual check-in and boarding, which, while safe, dramatically slowed throughput.

Because MUSE is widely used across European airports, the disruption had an almost domino-like effect. What makes platforms like MUSE efficient in normal times—their standardised, shared nature—also makes them a single point of failure when compromised. Within hours of the incident, queues were reported across terminals in Heathrow, Brussels, and Berlin, and airlines had no option but to reallocate staff for manual processing.

The affected systems were isolated from air traffic control or flight safety functions, which meant flight operations in the air remained secure. The pain, however, was on the ground, where passengers experienced hours-long delays and carriers dealt with the cost of cancelled or diverted flights.

How did airports across Europe respond, and which early signs showed recovery was underway?

The first priority for Heathrow, Brussels, and Berlin Brandenburg was continuity. All three airports activated contingency plans, bringing in staff to replace digital systems with manual operations. Airlines were told to advise passengers to arrive earlier and monitor their flight status closely. At Brussels, the impact was most severe, and management cut Sunday departures by half to reduce passenger congestion and allow time for MUSE systems to be restored. Heathrow, the busiest European hub, relied on airline-level backups and reported that most flights operated, albeit with longer queues. Berlin flagged extended delays on Saturday but by Sunday said the backlog was easing as automated functions began coming back online.

The recovery followed the familiar rhythm of cyber remediation: partial containment, validation of restored functions, and phased reactivation of systems. Kiosks came online first, followed by bag drop facilities, with full lane capacity restored gradually. That staged recovery explains why airports reported different timelines even though the root cause was the same.

Why does a check-in software cyber incident matter for aviation resilience, and what does this reveal about third-party risk?

The incident illustrates the scale of vulnerability that comes with relying on third-party vendors for mission-critical airport technology. Passenger check-in and baggage systems may not control aircraft safety, but they are central to customer experience and airline schedules. If a shared software layer goes down, every stakeholder—from airlines and airports to passengers—feels the consequences immediately.

Analysts have long warned that this concentration of critical systems in the hands of a few suppliers makes aviation infrastructure especially vulnerable to cyber disruption. The challenge is not only defending against attacks but also maintaining operational resilience when an incident occurs. Industry experts argue that airports must move toward more robust failover systems, better segmentation of networks, and contingency drills that go beyond paper exercises. This is particularly urgent given the rise in cyber incidents targeting European infrastructure in recent months.

The European Union has already been tightening its regulatory framework with initiatives such as NIS2, which imposes stricter reporting obligations and resilience requirements on critical infrastructure providers. After this disruption, airports and regulators are likely to push harder for contractual guarantees on recovery time, stronger transparency into vendor supply chains, and periodic resilience testing.

What is Collins Aerospace saying about the scope of the incident, and how are global outlets characterising the impact?

RTX’s Collins Aerospace described the event as a “cyber-related disruption” affecting select airports and limited to electronic check-in and baggage services. Independent reporting across Reuters, the Financial Times, and other outlets echoed this description, with most delays and cancellations attributed to the temporary loss of automated passenger processing. By late Saturday and into Sunday, airports reported progressive improvements, particularly in London and Berlin, though Brussels faced a slower recovery. Importantly, there was consistent messaging from both the company and airports that flight safety was never in jeopardy.

Investigators have yet to identify the source of the incident or confirm whether it was a targeted attack or a systems vulnerability exploited opportunistically. The lack of attribution at this stage underscores both the complexity of aviation IT environments and the cautious tone of official communications, where premature speculation could further unsettle passengers and markets.

How should investors interpret the immediate stock signal for RTX Corporation?

RTX shares closed Friday at $158.24, slightly lower on the day, and remained unchanged as markets were closed when the disruption unfolded over the weekend. Early sentiment suggests the market views this as an operational disruption rather than a financial or safety crisis. That muted response reflects investor confidence in RTX’s diversified business lines, which span aerospace, defence, and high-margin aftermarket services.

For investors, the key questions are whether this incident leads to any material loss of airport contracts, increased liability from airlines, or regulatory penalties. At present, there is no evidence of such consequences, and history shows that similar incidents are absorbed by large aerospace suppliers if they act quickly and transparently. The diversified backlog of RTX’s defence and commercial aerospace contracts provides a buffer against isolated operational disruptions.

From an investment standpoint, RTX looks like a Hold in the near term. A Buy case would require evidence that Collins Aerospace turns this disruption into an opportunity to reinforce trust by upgrading resilience and retaining contracts without discounts. A Sell case would only be justified if the company experiences repeated failures or if financial liabilities from compensation and penalties begin to erode margins. The market will be watching RTX’s disclosures closely in the coming weeks, especially the detail of its post-incident review.

Which passengers and airports were hit hardest, and how did the disruption timeline unfold?

Brussels was the epicentre of cancellations and diversions. Airport authorities openly acknowledged the severity of the disruption and cut Sunday departures by 50 percent to stabilise operations. Heathrow, despite being Europe’s busiest international hub, saw fewer cancellations thanks to robust airline-level systems, although passengers endured long queues and significant delays. Berlin reported widespread delays Saturday but noted improvements by Sunday morning as systems were restored.

The timeline was typical of a cyber event. Saturday was marked by sharp disruption and heavy manual processing, with long queues and a visible impact on travellers. By Sunday, partial restorations began to ease congestion. The full restoration of services is likely to take several more days as systems are tested and brought back online securely.

What lessons will the aviation sector and regulators draw from this incident?

The Collins Aerospace cyber disruption will strengthen calls for greater resilience and transparency in aviation IT procurement. Three lessons are already emerging. First, vendor concentration risk is now a pressing strategic concern for airports. Contract tenders are likely to demand multiple suppliers or redundant systems to avoid dependence on a single vendor. Second, operational drills for cyber resilience need to be more rigorous and transparent, with evidence that airports can maintain service quality even under manual fallback conditions. Third, regulators will press vendors to provide greater visibility into their software supply chains, ensuring that vulnerabilities are identified and mitigated earlier.

For Collins Aerospace, the near-term priority is clear communication and rapid remediation. Longer term, the company can position itself as a leader in resilience by hardening its platforms with zero-trust security, improved segmentation, and continuous monitoring. Turning an incident into a case study in successful recovery could mitigate reputational risk and even strengthen customer loyalty.

Why does this story matter beyond one weekend of delays, and what should investors and policymakers watch next?

This incident is not simply an “IT glitch.” It is a stark reminder that cyber resilience in aviation is no longer a back-office concern but a frontline operational risk with direct consequences for passengers, airlines, and investors. The disruption showed how quickly local failures can cascade across borders in a highly interconnected industry. While public confidence was preserved by clear assurances that flight safety was never endangered, the event underscores the need for regulators to tighten oversight and for vendors like Collins Aerospace to reframe resilience as a competitive differentiator.

For investors, the focus will be on how RTX manages disclosure and customer relationships in the coming weeks. Markets will want a credible timeline of detection, containment, and recovery, as well as evidence that airports intend to maintain long-term contracts with Collins Aerospace. If the company provides transparency and reassures stakeholders, the market will likely treat this as a contained operational event rather than a long-term risk.

How should investors and regulators interpret the Collins Aerospace cyber disruption in the broader context of aviation security?

The Collins Aerospace cybersecurity event represents a classic third-party risk incident—operationally disruptive but strategically recoverable. The fact that passenger systems failed while flight safety remained intact speaks to the compartmentalisation of aviation IT, but it also highlights the urgency of reinforcing resilience where public trust is most visible. For airports, resilience is now a differentiator; for Collins Aerospace, the opportunity lies in turning crisis management into a trust dividend.