Arrest Made Over Heathrow Cyberattack — Was Any Passenger Data Stolen?

UK police have arrested a man in connection with the cyberattack that disrupted operations at Heathrow and several other European airports last weekend. The suspect, in his 40s from West Sussex, was detained under the Computer Misuse Act and later released on conditional bail.

While the arrest marks progress, investigators are still trying to establish whether the incident was limited to system disruption or whether passenger data may have been accessed. The question of personal information remains at the centre of the inquiry.

Investigation Ongoing

The National Crime Agency (NCA), supported by its national cybercrime unit, confirmed the arrest on 24 September. Deputy Director Paul Foster said the development was a positive step but stressed that the investigation was still in its early stages.

The attack targeted Collins Aerospace's MUSE check-in platform, which is widely used by airlines at major airports, according to BBC. Disruption to the system forced staff to switch to manual processes, affecting boarding and baggage handling across several hubs.

Airports Disruption

At Heathrow, around 20 flights were cancelled and many more delayed. Passengers at Terminal 4 described long queues, confusion and uncertainty over whether they would make their planned trips as airlines switched to manual procedures, according to The Guardian.

The disruption began on Friday night and continued through the weekend. At Brussels Airport, 50 outbound flights were cancelled on Sunday and nearly 140 on Monday, according to Argus. Airports in Berlin and Dublin also reported cancellations and delays, highlighting the wide scale of the impact.

Officials confirmed that air traffic control and flight safety systems were not compromised. The European Commission stated that aviation safety remained fully intact despite the temporary difficulties faced by passengers and airlines. The affected systems were largely passenger-facing ones, including check-in desks, baggage tagging equipment and boarding procedures.

Passenger Data Concerns

There is currently no evidence that passenger information was stolen. Reuters reported that none of the main hacker forums or so-called dark web leak sites has published records linked to the attack, and no group has claimed responsibility.

Cybersecurity analysts noted that many ransomware cases begin by disrupting systems, with data theft sometimes carried out as a secondary step. Forensic teams are now reviewing server logs, access records and network traffic to determine whether information such as names, passport numbers or contact details were accessed.

Potential Risks

If passenger data was compromised, affected individuals could face identity fraud, phishing attempts or other cybercrime. Airlines and airports could also face reputational damage, regulatory scrutiny under data protection laws and potential compensation claims.

The bail conditions for the suspect and the direction of any legal proceedings will depend on what the forensic investigation uncovers. Pressure is likely to increase on authorities to provide clarity once the technical review is complete.

Next Steps

The Heathrow-linked cyberattack has been described by analysts as a significant test of airport resilience to digital threats. Aviation systems have been targeted before, but large-scale incidents remain rare. The outcome of this inquiry could shape future cooperation between UK and European regulators on cybersecurity standards in the sector.

For now, the arrest represents an important milestone, but the scale of the breach will only be clear once investigators conclude whether the attack was a temporary disruption or something more serious involving personal data.