bbc.com
Imran Rahman-JonesTechnology reporter andJoe TidyCyber correspondent, BBC World Service

The National Crime Agency (NCA) said a man in his forties was arrested in West Sussex.

A person has been arrested in connection with a cyber-attack which has caused days of disruption at several European airports including Heathrow.

The National Crime Agency (NCA) said a man in his forties was arrested in West Sussex "as part of an investigation into a cyber incident impacting Collins Aerospace".

There have been hundreds of flight delays after Collins Aerospace baggage and check-in software used by several airlines failed, with some boarding passengers using pen and paper.

"Although this arrest is a positive step, the investigation into this incident is in its early stages and remains ongoing," said Paul Foster, head of the NCA's national cyber crime unit.

The man was arrested on Tuesday evening on suspicion of Computer Misuse Act offences and has been released on bail.

The BBC has seen an internal memo sent to airport staff at Heathrow about the difficulties software provider Collins Aerospace is having bringing their check-in software back online.

The US company appears to be rebuilding the system again after trying to relaunch it on Monday.

Collins Aerospace's parent company RTX Corporation told the BBC it appreciated the NCA's "ongoing assistance in this matter".

The US firm has not put a timeline on when it will be ready and is urging ground handlers and airlines to plan for at least another week of using manual workarounds.

At Heathrow, extra staff have been deployed in terminals to help passengers and check-in operators but flights are still experiencing delays.

On Monday, the EU's cyber-security agency said ransomware had been deployed in the attack.

Ransomware is often used to seriously disrupt victims' systems and a ransom is demanded in cryptocurrency to reverse the damage.

These types of attacks are an issue for organisations around the country, with organised cyber-crime gangs earning hundreds of millions of pounds from ransoms every year.

Days of disruption
The attack against US software maker Collins Aerospace was discovered on Friday night and resulted in disruption across many European airports, including in Brussels, Dublin and Berlin.

Flights were cancelled and delayed throughout the weekend, with some airports still experiencing effects of the delays into this week.

"The vast majority of flights at Heathrow are operating as normal, but we encourage passengers to check the status of their flight before travelling to the airport," Heathrow Airport said in a statement on its website.

Berlin Airport said on Wednesday morning "check-in and boarding are still largely manual", which would result in "longer processing times, delays, and cancellations by airlines".

While Brussels Airport advised passengers to check in online before arriving at the airport.

Cyber-attacks in the aviation sector have increased by 600% over the past year, according to a report by French aerospace company Thales.

bbc.com Joe TidyCyber correspondent and
Tabby Wilson

The EU's cyber security agency says criminals are using ransomware to cause chaos in airports around the world.

Several of Europe's busiest airports have spent the past few days trying to restore normal operations, after a cyber-attack on Friday disrupted their automatic check-in and boarding software.

The European Union Agency for Cybersecurity, ENISA, told the BBC on Monday that the malicious software was used to scramble automatic check-in systems.

"The type of ransomware has been identified. Law enforcement is involved to investigate," the agency said in a statement to news agency Reuters.

It's not known who is behind the attack, but criminal gangs often use ransomware to seriously disrupt their victims' systems and demand a ransom in bitcoin to reverse the damage.

The BBC has seen internal crisis communications from staff inside Heathrow Airport which urges airlines to continue to use manual workarounds to board and check in passengers as the recovery is ongoing.

Heathrow said on Sunday it was still working to resolve the issue, and apologised to customers who had faced delayed travel.

It stressed "the vast majority of flights have continued to operate" and urged passengers to check their flight status before travelling to the airport.

The BBC understands about half of the airlines flying from Heathrow were back online in some form by Sunday - including British Airways, which has been using a back-up system since Saturday.
Continued disruption

The attack against US software maker Collins Aerospace was discovered on Friday night and resulted in disruption across several airports on Saturday.

While this had eased significantly in Berlin and London Heathrow by Sunday, delays and flight cancellations remained.

Brussels Airport, also affected, said the "service provider is actively working on the issue" but it was still "unclear" when the issue would be resolved.

They have asked airlines to cancel nearly 140 of their 276 scheduled outbound flights for Monday, according to the AP news agency.

Meanwhile, a Berlin Airport spokesperson told the BBC some airlines were still boarding passengers manually and it had no indication on how long the electronic outage would last.