The UK’s National Crime Agency (NCA) has arrested a man in West Sussex in connection with the ransomware attack that disrupted airport operations and caused widespread flight delays across Europe last week.
The attack targeted the Multi-User System Environment (MUSE), a check-in software developed by Collins Aerospace that allows multiple airlines to share a single desk. While major carriers such as British Airways quickly switched to backup systems, many smaller airlines were forced to manually check in passengers and luggage, leading to long delays at airports including London Heathrow and Berlin Brandenburg.
The NCA confirmed the arrest of “a man in his forties,” who has since been released on conditional bail as investigations continue. The agency has not shared further details about the suspect.
Cybersecurity experts suggest the attack may have been carried out with relatively unsophisticated ransomware tools. Researcher Kevin Beaumont pointed to Hardbit ransomware, while other sources cited by BleepingComputer indicate it could have been Loki ransomware. Both are Ransomware-as-a-Service (RaaS) tools often used in smaller-scale attacks, raising questions about how such malware was able to disrupt on a continental scale.
The investigation is ongoing, and more details are expected in the coming weeks.





