Drones And Cyberattacks Plague European Airports

Passengers stand in a queue to get new tickets at the service point of the Copenhagen Airport in Copenhagen, Denmark, on September 23, 2025. Danish police said that whoever was responsible for flying large drones over Copenhagen airport appeared to have been knowledgeable, as flights resumed in Denmark and Norway capitals following a night of travel chaos. Airports in Copenhagen and Oslo reopened on Tuesday, September 23, hours after unidentified drones in their airspace caused dozens of flights to be diverted or cancelled, disrupting thousands of passengers. (Photo by Sergei GAPON / AFP) (Photo by SERGEI GAPON/AFP via Getty Images)

AFP via Getty Images

European airports have faced a wave of disruptions this week, with coordinated incidents involving drone incursions and cyberattacks that have exposed weaknesses in both physical and digital aviation security systems.

Drone Incursions Shut Down Scandinavian Airports

Copenhagen Airport, Scandinavia’s second-busiest hub, was forced to halt all traffic for nearly four hours on Monday evening after sightings of multiple drones near the airfield. At least 50 flights were diverted, leaving thousands of passengers stranded. Danish police described the drones as being flown by a “capable operator,” who was able to maneuver in and out of radar range and switch lights on and off to avoid detection. Officials called it the most serious attack yet on critical infrastructure.

Billund Airport, Denmark’s second-largest commercial airport, was closed for an hour due to drone activity. Aalborg, used for both commercial and military flights, was also closed for three hours on Wednesday night due to drone incursions.

Additional sightings were reported over Esbjerg and Sønderborg airports, as well as over Skrydstrup Air Base, which hosts some of Denmark’s F-16 and F-35 fighter jets.

As the BBC reported, Danish Prime Minister Mette Frederiksen described the drone incursions as “the most serious attack on Danish critical infrastructure to date.”

Frederiksen suggested a link to Russia, with recent Russian drone incursions in Poland and Romania, and fighter jet incursions in Estonian airspace. For its part, the Kremlin has described the allegation as “unfounded.”

Danish police police Inspector Jens Jespersen said evidence pointed to a “capable actor” carrying out the drone attack, with several large drones approaching the airport from different directions, “quite a long way away.” He said the unidentified drone operator had the “will and tools to show off… perhaps also to practice.”

Frederiksen said the intent behind the drone activity in Copenhagen was to “disrupt, create unrest… to see how far you can go and test the limits.”

Danish intelligence said the country faced a “high threat of sabotage.”

Norway also confirmed that Oslo Airport was targeted by drones, with a shutdown lasting about three hours. Authorities said they have not yet established a link between the Oslo and Copenhagen incidents.

Cyberattack Strikes Brussels, Berlin And London

At the same time, Brussels, Berlin’s Brandenburg and London’s Heathrow airport grappled with a cyberattack carried out this past Friday on Collins Aerospace’s MUSE system, which handles check-in, boarding and baggage. Airport staff resorted to manual check-in and handwritten boarding passes.

Brussels Airport was most affected, with multiple delays and cancellations. “The service provider is actively working on the issue and trying to resolve the problem as quickly as possible,” Brussels Airport said in a statement.

The Brussels Times reported the airport was still in recovery on Monday, with constrained operations expected through Tuesday, and had requested that airlines reduce their schedules by half to ease pressure.

Berlin Brandenburg and London Heathrow also reported cancellations and delays.

“This was a very clever cyberattack indeed,” travel analyst Paul Charles told AP. “It hit a central system used at multiple airports, exposing just how interdependent aviation IT has become.”

Cybersecurity expert Rafe Pilling of Sophos said the incident “highlighted the fragile and interdependent nature of the digital ecosystem underpinning air travel.”

The UK’s National Crime Agency announced it had arrested a suspect in the cyberattack on Wednesday, described as “a man in his forties in West Sussex.” He was later released on conditional bail.

“Although this arrest is a positive step, the investigation into this incident is in its early stages and remains ongoing,” said Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit. “Cybercrime is a persistent global threat that continues to cause significant disruption to the UK. Alongside our partners here and overseas, the NCA is committed to reducing that threat in order to protect the British public.”

A Hybrid Threat To Aviation

Although the two events may not be directly linked, Reuters reports that the combination of drones and cyberattacks has raised concerns among security experts over a hybrid threat—a physical and digital incursion on aviation that overwhelms defenses.

“First is to test how the method works. In this case, it leads to closing down airports,” Jukka Savolainen, network director at the European Centre of Excellence for Countering Hybrid Threats, told Reuters. “The second testing point is our reaction.”

Of the weekend hack of Collins Aerospace’s check-in software, Bart Salaets at U.S. cybersecurity firm F5 told Reuters: “This attack shows just how vulnerable highly connected industries like aviation can be.”

The incidents come during a period of heightened travel demand. While Europe’s summer holiday peak has passed, September remains a busy month for business travel and political events. In Brussels, the disruption coincided with European diplomats travelling to New York for the UN General Assembly.

For passengers, the result of these attacks was a cascade of cancellations, diversions, and long waits at terminals.

Airlines, airports, and authorities face the challenge of hardening critical aviation infrastructure against increasingly sophisticated and potentially multi-layered threats.