The U.K.’s National Crime Agency (NCA) said on Wednesday that a man was arrested in connection to the ransomware attack that has caused delays and disruptions at several European airports since the weekend.
The hack, which began Friday, targeted check-in systems provided by Collins Aerospace, causing delays at Brussels, Berlin, and Dublin airports, as well as London’s Heathrow, which lasted until yesterday.
While the NCA did not name the arrested man, the agency said he is “in his forties” and that he was arrested in the southern county of West Sussex on Tuesday under the country’s Computer Misuse Act “as part of an investigation into a cyber incident impacting Collins Aerospace.”
The man was released on conditional bail, according to the agency.
“Although this arrest is a positive step, the investigation into this incident is in its early stages and remains ongoing,” said Paul Foster, deputy director and head of the NCA’s National Cyber Crime Unit, in a statement.
When reached by TechCrunch, NCA spokesperson Richard Crowe said the agency had nothing else to add beyond the press release.
The Friday cyberattack saw widespread travel delays and disruption, including boarding passes failing at departure gates and some flight cancellations, as much of the affected airports and airlines had to resort to manual check-ins.
RTX (formerly Raytheon Technologies), the defense contractor giant that owns Collins Aerospace, confirmed in a legally required notice filed with the U.S. Securities and Exchange Commission on Wednesday that the cyberattack was related to ransomware.
In the 8-K notice seen by TechCrunch, RTX described the cybersecurity incident as “involving ransomware,” without providing specifics about the kind of ransomware used or the criminal hackers behind the breach.
The company said that the incident affected its check-in software, which resides “on customer-specific networks.”
“Our customers have shifted to back-up or manual processes and have experienced certain flight delays and cancellations,” said RTX.
RTX’s confirmation that ransomware was to blame for the outage was first revealed by European cybersecurity agency ENISA on Monday.
A spokesperson for RTX did not respond to a request for comment.
Updated with new information from RTX’s SEC filing.
