Supply-chain ransomware, one year after the European airports outage

Twelve months ago, in September 2025, a ransomware attack on Collins Aerospace's Multi User System Environment (MUSE), a shared passenger handling platform, disrupted operations at Heathrow, Brussels and Berlin airports. At least 217 flights were cancelled, thousands of passengers were affected and staff reverted to manual bag registration, ticketing and gate assignment. The attackers did not need to breach three airports. They needed to breach one supplier.

September 2026 has produced a fresh set of reminders that the structure of the problem has not changed.

What happened this September

• Berlin's state government had two departments compromised in early September, with data subsequently published by the attackers.
• VMware vCenter servers were being exploited by multiple ransomware groups through CVE-2026-59310, a critical remote code execution flaw in the hypervisor management plane, giving attackers network-wide access through a single appliance.
• Keio, a Japanese hospitality and transportation group, reported disruption of business systems at the end of the month, with the investigation ongoing.
• The same month saw zero-day exploitation of Citrix NetScaler, Cisco Secure Email Gateway and JetBrains TeamCity, each of them infrastructure that sits in front of or underneath many organisations at once.

The lesson that keeps repeating

The airports case demonstrated three things that remain true:

Concentration risk is the attacker's friend. Shared platforms, managed service providers, hypervisors and edge appliances are efficient targets. Compromising one yields access to many. Adversaries price their effort accordingly, which is why the exploited vulnerabilities of 2026 are overwhelmingly in infrastructure products rather than in end-user software.

Operational technology and real-time systems change the consequence profile. Earlier breaches hit isolated IT systems. The airports attack disabled a real-time operational platform, and the vCenter campaign targets the layer that runs everything. Recovery is no longer a matter of restoring files but of restoring an operating business under time pressure.

Regulatory regimes diverge, and that affects what the public learns. The airports incident was reported within Europe's NIS2 framework with coordinated incident reporting, while disclosure elsewhere was limited. Organisations operating across jurisdictions need one factual record that can feed multiple reporting regimes without contradiction.

What resilient organisations do differently

From our incident response and advisory work, the organisations that come through supplier-driven incidents in days rather than weeks share a few habits:

1. They know their critical dependencies. Not a spreadsheet of vendors, but a map of which supplier systems, hypervisors, identity providers and network appliances each critical business process depends on.
2. They have exercised the manual fallback. The airports kept flying because staff could operate with pen and paper. That capability exists only if it has been practised.
3. They separate trust boundaries. Backups that a compromised hypervisor administrator cannot delete. Identity providers that a compromised supplier cannot impersonate. Management interfaces that the internet cannot reach.
4. They keep the right logs. Supplier incidents raise the question "what did they have access to in our environment?" That is answerable only if access logs for supplier accounts and connections are retained and reviewable.
5. They contract for response. Supplier agreements specify notification timelines, forensic cooperation and evidence sharing. Incident response retainers are activated with one call rather than a procurement cycle.

For insurers

Supplier-driven events create correlated losses across a portfolio. The practical underwriting questions are which shared platforms an insured depends on, whether the insured has an exercised fallback for a supplier outage, and whether contracts give the insured the right to forensic evidence from the supplier. A portfolio view of shared dependencies is a view of accumulation risk.

Sources

• Lawfare: Lessons from the European airports ransomware attack
• CM Alliance: Major cyber attacks, data breaches and ransomware attacks, September 2026
• BleepingComputer: CISA says critical VMware vCenter RCE flaw now exploited by ransomware gangs