The disruption that rippled across European skies this weekend, halting check-in and boarding at major airports including London Heathrow, Brussels, and Berlin, was no ordinary technical glitch. Collins Aerospace, a U.S.-based provider of airline check-in and boarding systems, experienced what was described as a “technical issue.” Yet when that issue simultaneously paralyzes some of Europe’s busiest transit hubs, disrupting tens of thousands of passengers on a Saturday travel rush, the suspicion naturally shifts toward something more deliberate: a coordinated cyberattack.
Such an incident has all the hallmarks of a state-sponsored operation. The aviation sector is an attractive target: highly visible, symbolically important, and operationally critical. Shutting down or even delaying airline systems doesn’t just inconvenience travelers; it strikes at the heart of economic stability and public confidence. For a state actor, the motive may not be theft or profit but influence, disruption, and demonstration of capability.
Russia emerges as the most probable suspect. Over the past decade, Russian-linked groups have repeatedly targeted critical infrastructure across Europe—from power grids in Ukraine to government servers in the Baltics—often timed with geopolitical flashpoints. Disrupting airports in Europe fits with Moscow’s hybrid warfare playbook, which thrives on creating anxiety, underlining vulnerability, and forcing governments to divert resources. The symbolic resonance of hitting both the U.K. and EU transport nodes in a single blow would be particularly appealing in the context of ongoing tensions with NATO and Western sanctions.
China, while less overtly disruptive in its cyber operations, cannot be ruled out. Beijing has long been interested in mapping and probing Western aerospace and defense supply chains. Collins Aerospace sits at the intersection of civilian airline infrastructure and sensitive military technologies, making it a logical reconnaissance target. If China were behind such an attack, the goal might be less about causing chaos and more about stress-testing Western resilience, observing incident response, and identifying vulnerabilities that could be exploited in a future crisis.
Iran also has form in this domain. Its cyber units have targeted transport systems in the past, often in retaliation for sanctions or military actions in the Middle East. A disruption at European airports could serve as a message to Western governments aligned with Israel or enforcing restrictions on Tehran. Though less technically sophisticated than Russia or China, Iranian-linked groups are aggressive, opportunistic, and increasingly adept at disruptive cyber operations.
North Korea is a more remote but still possible suspect. Pyongyang’s operators are primarily focused on financial theft to support the regime, but occasionally they demonstrate disruptive capabilities. An attack on airline infrastructure would be a signal event rather than a strategic campaign, intended to show that the regime can reach far beyond the Korean Peninsula.
What makes Russia the likeliest culprit is not only its technical capacity but also the consistency of its doctrine. Disruptions of this kind serve Moscow’s narrative: that Western societies are fragile, that daily life can be interrupted at will, and that no amount of defense spending guarantees normalcy. In this sense, the attack need not aim at long-term penetration. The simple fact of grounding flights across multiple European capitals is enough to achieve its purpose—spreading uncertainty and amplifying geopolitical tension.
While the technical forensics will take time, the strategic picture is clear. This was not just an IT failure at a contractor’s servers. It was almost certainly a deliberate act of disruption, with state fingerprints all over it. The skies above Europe may have cleared, but the signal from the ground is unmistakable: critical infrastructure is now a battlefield, and the adversaries are willing to strike where it hurts most—at the gateways of international mobility itself.