Heathrow braces for second day of disruption after cyber-attack

A cyber-attack on RTX's Collins Aerospace Muse software has caused significant disruption to check-in and baggage systems at several European airports, including Heathrow and Brussels, leading to widespread flight delays and cancellations. The incident has forced manual operations, with Brussels Airport requesting airlines cancel half their departing flights, highlighting the aviation industry's acute vulnerability to digital infrastructure failures. While RTX confirms a 'cyber-related disruption' and is working on a resolution, the lack of a clear timeline creates ongoing operational uncertainty for affected carriers and airports.

Analysis

A cyber-attack on the Muse software, provided by RTX's Collins Aerospace subsidiary, has triggered significant operational disruptions across major European airports, most notably at Heathrow and Brussels. The failure of the check-in and baggage system has led to substantial flight delays, with 47% of Heathrow's departing flights impacted on Saturday, and widespread cancellations, as Brussels Airport requested airlines to cut 50% of their schedules. The incident has forced a reversion to manual, paper-based processing, highlighting a critical vulnerability in the aviation industry's dependence on third-party digital infrastructure. While RTX has acknowledged the 'cyber-related disruption,' the company has not yet provided a timeline for resolution or details on the attack's nature, creating uncertainty for affected airlines and airports. The situation is reminiscent of a previous industry-wide IT failure caused by a Crowdstrike update, underscoring this as a recurring systemic risk. The involvement of national and European cybersecurity and transport authorities indicates the severity of the event and potential for regulatory scrutiny.

Key Decisions for Investors

• Investors in RTX should monitor for company disclosures on the breach's scope, remediation costs, and potential liabilities, as the current opacity and strong negative sentiment (-0.7) represent a significant near-term reputational and financial risk.
• This event highlights a key operational risk for airlines; it is prudent to assess portfolio holdings for exposure to carriers dependent on the Muse system, while noting the operational resilience demonstrated by unaffected competitors like Ryanair (RYAAY).
• For the broader technology and cybersecurity sectors, the incident underscores the significant liability and reputational damage that can arise from single points of failure in critical infrastructure software, a risk factor to consider for companies like CrowdStrike (CRWD) mentioned in the article.