Client Alert: Lessons Learned From Cyber Attack Disrupting European Airports

Client Alert: Lessons Learned From Cyber Attack Disrupting European Airports
September 24, 2025 5 mins

Client Alert: Lessons Learned From Cyber Attack Disrupting European Airports

Client Alert: Lessons Learned From Cyber Attack Disrupting European Airports

A cyber attack on September 20 disrupted operations at major European airports, exposing how dependent the sector is on third-party technology — and how quickly disruption can cascade across the supply chain.

Key Takeaways
  1. Third-party risk is a persistent vulnerability in aviation, transportation, and logistics. Aon’s CyQu data shows these sectors consistently score lowest in supplier oversight and business continuity maturity.
  2. Manual back-up procedures are not sufficient to maintain operational resilience. The disruption at European airports highlights the limitations of analogue alternatives when digital systems fail.
  3. Cyber insurance is a strategic tool for managing outage risk. Dependent business interruption clauses offer critical protection and can drive stronger governance across the IT/OT estate.

The recent cyber attack that disrupted check-in, boarding and baggage-drop systems across several European airports brought the fragility of the aviation industry’s digital backbone into sharp focus. 

With operations severely impacted at scale by a third-party technology outage, the event is the latest example of the vulnerabilities highlighted in Aon’s 2025 Global Cyber Risk Report. In particular, it underscores our diagnostic tool, CyQu’s findings around third-party risk and business continuity, where maturity remains stubbornly low in the aviation and transportation and logistics industries.

Another Case Study in Systemic Third-Party Risk

Reports indicate that a failure at a third-party supplier cascaded across multiple airports forcing a reversion to manual processes. Passenger queues stretched for hours, flights were canceled and operational efficiency plummeted.1

This dependency on external technology providers is not unique to any of the impacted airports: modern airports rely on complex ecosystems of vendors for baggage handling, ticketing, scheduling and security. When a single node fails, the effects are immediate and severe. Aon’s CyQu data confirms that third-party risk consistently scores among the weakest maturity domains across Europe, the Middle East and Africa, reflecting a lack of visibility, inconsistent contract standards and limited assurance of supplier resilience. 

This cyber incident also has parallels to the CrowdStrike outage that occurred in July 2024. While this event differs given reports of malicious attack elements against the impacted software provider,2 the criticality of a key software embedded in the supply chain and overall delivery model serve as another scenario companies must consider when evaluating outage risk in the aviation and transportation and logistics industries.

The Interconnected IT Landscape of Aviation

Airports are among the most complex operational environments in the world. Core passenger systems integrate check-in and boarding, baggage logistics, biometric security, customs and immigration databases and airline scheduling platforms. Many of these systems are delivered by specialist third-party providers and linked via shared software and cloud infrastructure. 

A disruption at a third-party vendor does not remain isolated; it immediately propagates across the entire chain of connected services, and in some cases, across multiple countries. Heathrow’s manual fallback illustrated both the resilience of human operations and the limits of analogue alternatives when millions of passengers are expected to move seamlessly each day.

CyQu Security Domains: Where Aviation Falls Short

Aon’s CyQu framework measures maturity across a dozen domains on a four-point scale. In EMEA, the overall average score is 2.53, but the spread is uneven. Domains such as endpoint protection and network security often score closer to 3.0, reflecting investment in traditional technical controls. By contrast, third-party risk management and business resilience frequently sit closer to the 2.0 mark, a full point lower than technical domains.

This gap matters. In industries like finance or utilities, regulatory oversight has forced higher maturity in continuity and third-party controls. By comparison, the aviation and transportation and logistics industries tend to score below average because of their sprawling supplier ecosystems and less standardized resilience requirements. Heathrow’s experience is therefore not an outlier but representative of broader structural weaknesses in the sector.

Business Continuity Under Pressure

The ability of the impacted airports to shift to manual operations demonstrates preparedness, but the scale of the remaining disruption reflects the challenge. Aon’s EMEA analysis suggests that business continuity and resilience consistently score lower than most technical control domains. This incident validates this finding: continuity planning potentially did not fully anticipate or mitigate the systemic disruption caused by a critical supplier outage.

The Role of Cyber Insurance

Cyber insurance is not only a financial backstop, protecting balance sheets from adverse, severe, risks but also an effective, practical risk management tool. Public reporting suggests that this latest incident is exactly the type of event that would be insurable under a comprehensive policy.

Most notably, dependent business interruption clauses extend coverage to losses caused by direct suppliers — a critical feature for aviation where third-party reliance is the norm. Such policies may cover revenue loss, extra expense and recovery costs triggered by a vendor failure. In addition, underwriting frameworks often drive security improvements for insureds, a finding which is further drawn out in the Aon Cyber Risk Report 2025. This in turn may address governance challenges around the successful management of cyber risk in the IT/OT estate.

The Path Forward

For the aviation and transportation and logistics industries, six imperatives emerge:

  • Identify key technologies that may become a single point of failure for business operations.
  • Assess their risk management posture, evaluating security controls of their business on a regular cadence.
  • Analyze the impact of the risk, understanding the financial impact of unforeseen scenarios the system could have on your business.
  • Strengthen oversight and contractual controls with third-party providers.
  • Update business continuity plans to realistically model systemic vendor failures.
  • Leverage cyber insurance not only for protection, but as a catalyst for stronger governance and resilience.

These events impacting airports and airlines are not an anomaly — they are a symptom of an increasingly challenging threat environment driven by threat actors targeting elements of operational supply chains. Aon’s 2025 Cyber Risk Report makes clear that unless third-party risk management and business continuity are addressed with urgency, the aviation industry may remain acutely vulnerable to cyber incidents.

Aon's Thought Leaders
  • David Molony
    Head of Cyber, Europe, the Middle East and Africa
  • Brent Rieth
    Global Head of Cyber Solutions
  • Adam Peckman
    Global Cyber Risk Consulting Leader & Head of Risk Consulting & Cyber Solutions, Asia Pacific
  • Sergio Torres
    Specialty Leader, Financial & Professional Services & Cyber, Latin America

1 https://www.reuters.com/en/cyberattack-causes-flight-delays-cancellations-brussels-airport-2025-09-20/
2 https://www.bbc.co.uk/news/articles/cqjeej85452o

General Disclaimer

The information contained herein and the statements expressed are of a general nature and are not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information and use sources we consider reliable, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. This information is not a replacement for legal, tax accounting or other professional advice and no one should act on such information without appropriate professional advice after a thorough examination of the particular situation.

Terms of Use

The contents herein may not be reproduced, reused, reprinted or redistributed without the expressed written consent of Aon, unless otherwise authorized by Aon. To use information contained herein, please write to our team.

Aon's Better Being Podcast

Our Better Being podcast series, hosted by Aon Chief Wellbeing Officer Rachel Fellowes, explores wellbeing strategies and resilience. This season we cover human sustainability, kindness in the workplace, how to measure wellbeing, managing grief and more.

Aon Insights Series Asia

Expert Views on Today's Risk Capital and Human Capital Issues

Aon Insights Series Pacific

Expert Views on Today's Risk Capital and Human Capital Issues

Aon Insights Series UK

Expert Views on Today's Risk Capital and Human Capital Issues

Client Trends 2025

Better Decisions Across Interconnected Risk and People Issues.

Construction and Infrastructure

The construction industry is under pressure from interconnected risks and notable macroeconomic developments. Learn how your organization can benefit from construction insurance and risk management.

Cyber Labs

Stay in the loop on today's most pressing cyber security matters.

Cyber Resilience

Our Cyber Resilience collection gives you access to Aon’s latest insights on the evolving landscape of cyber threats and risk mitigation measures. Reach out to our experts to discuss how to make the right decisions to strengthen your organization’s cyber resilience.

Employee Wellbeing

Our Employee Wellbeing collection gives you access to the latest insights from Aon's human capital team. You can also reach out to the team at any time for assistance with your employee wellbeing needs.

Environmental, Social and Governance Insights

Explore Aon's latest environmental social and governance (ESG) insights.

Q4 2023 Global Insurance Market Insights

Our Global Insurance Market Insights highlight insurance market trends across pricing, capacity, underwriting, limits, deductibles and coverages.

Global Risk Management Survey

Better Decisions Across Interconnected Risk and People Issues.

Regional Results

How do the top risks on business leaders’ minds differ by region and how can these risks be mitigated? Explore the regional results to learn more.

Top 10 Global Risks

Trade, technology, weather and workforce stability are the central forces in today’s risk landscape.

Industry Insights

These industry-specific articles explore the top risks, their underlying drivers and the actions leaders are taking to build resilience.

Human Capital Analytics

Our Human Capital Analytics collection gives you access to the latest insights from Aon's human capital team. Contact us to learn how Aon’s analytics capabilities helps organizations make better workforce decisions.

Human Capital Quarterly Insights Briefs

Read our collection of human capital articles that explore in depth hot topics for HR and risk professionals, including using data and analytics to measure total rewards programs, how HR and finance can better partner and the impact AI will have on the workforce.

Insights for HR

Explore our hand-picked insights for human resources professionals.

Workforce

Our Workforce Collection provides access to the latest insights from Aon’s Human Capital team on topics ranging from health and benefits, retirement and talent practices. You can reach out to our team at any time to learn how we can help address emerging workforce challenges.

Mergers and Acquisitions

Our Mergers and Acquisitions (M&A) collection gives you access to the latest insights from Aon's thought leaders to help dealmakers make better decisions. Explore our latest insights and reach out to the team at any time for assistance with transaction challenges and opportunities.

Natural Resources and Energy Transition

The challenges in adopting renewable energy are changing with technological advancements, increasing market competition and numerous financial support mechanisms. Learn how your organization can benefit from our renewables solutions. 

Navigating Volatility

How do businesses navigate their way through new forms of volatility and make decisions that protect and grow their organizations?

Parametric Insurance

Our Parametric Insurance Collection provides ways your organization can benefit from this simple, straightforward and fast-paying risk transfer solution. Reach out to learn how we can help you make better decisions to manage your catastrophe exposures and near-term volatility.

Pay Transparency and Equity

Our Pay Transparency and Equity collection gives you access to the latest insights from Aon's human capital team on topics ranging from pay equity to diversity, equity and inclusion. Contact us to learn how we can help your organization address these issues.

Property Risk Management

Forecasters are predicting an extremely active 2024 Atlantic hurricane season. Take measures to build resilience to mitigate risk for hurricane-prone properties.

Technology

Our Technology Collection provides access to the latest insights from Aon's thought leaders on navigating the evolving risks and opportunities of technology. Reach out to the team to learn how we can help you use technology to make better decisions for the future.

Trade

Our Trade Collection gives you access to the latest insights from Aon's thought leaders on navigating the evolving risks and opportunities for international business. Reach out to our team to understand how to make better decisions around macro trends and why they matter to businesses.

Transaction Solutions Global Claims Study

Better Decisions Across Interconnected Risk and People Issues.

Weather

With a changing climate, organizations in all sectors will need to protect their people and physical assets, reduce their carbon footprint, and invest in new solutions to thrive. Our Weather Collection provides you with critical insights to be prepared.

Workforce Resilience

Our Workforce Resilience collection gives you access to the latest insights from Aon's Human Capital team. You can reach out to the team at any time for questions about how we can assess gaps and help build a more resilience workforce.

More Like This

View All
View All
Subscribe CTA Banner