ARINC’s MUSE system disruption causes flight delays

Reports of a cyberattack on major European airports have surfaced, with disruptions being observed in check-in, boarding, and kiosk systems at airports like Heathrow, Brussels, Berlin, and Dublin. These outages have been linked to Collins Aerospace’s passenger processing platform MUSE, a widely-used system in many international airports. Although media reports have depicted the incident as a ransomware attack based on information from the European Union Agency for Cybersecurity, an official statement from the agency is yet to be released.

Authorities in the UK made an arrest in West Sussex, as reported by the National Crime Agency and later by BBC News. The suspect was released on conditional bail, and investigations into the matter are ongoing. The specific variant of ransomware behind the airport disruption has not been officially confirmed. While there have been speculations about the involvement of ransomware operators like HardBit, BlackBit, and LokiLocker, none of these families have been definitively linked to the incident.

Questions remain unanswered regarding the ransomware variant, the method of intrusion, the full extent of affected airports and airlines, and the identity of the responsible actor. Whether data was exfiltrated, ransom demands were made, and the nature of the perpetrator, whether criminal, state-sponsored, or an insider, are all aspects that are yet to be determined.

Collins Aerospace’s ARINC MUSE platform, which includes the vMUSE and cMUSE offerings, functions as a common-use passenger processing system that facilitates shared check-in counters, kiosks, and boarding gates for multiple airlines. While the system streamlines operations and reduces costs, it presents a single point of failure that can have cascading effects on airport operations. The recent disruptions highlight the vulnerability of relying on third-party vendors for critical software services within the aviation sector.

The aviation industry has faced similar risks in the past, such as the 2021 SITA data breach and the activities of groups like Scattered Spider targeting outsourced IT providers. The exposure of the sector to advanced criminal groups underscores the need for enhanced cybersecurity measures and vigilance among airports and airlines.

Delhi Airport’s apparent immunity to the recent cyberattack affecting other airports using MUSE raises questions about the attackers’ targeting strategy and the effectiveness of India’s IT security measures. The Indian IT Ministry’s prompt response to the situation demonstrates the importance of proactive security protocols in mitigating potential cyber threats.

Official disclosure from RTX Corporation confirmed the ransomware incident involving its MUSE passenger processing software, marking the first formal acknowledgment of the ransomware attack impacting airport systems. As per regulatory requirements, U.S. companies must report significant events like cybersecurity incidents that could impact investors or operations, even if the financial consequences are deemed immaterial.

In conclusion, the cyberattack on European airports underscores the critical need for robust cybersecurity measures across the aviation industry. The interconnected nature of common-use passenger processing systems heightens the vulnerability of airports and airlines to cyber threats, necessitating proactive security protocols and close collaboration between industry stakeholders to safeguard critical infrastructure and passenger data.