UK Air Traffic Control Chief Rules Out Cyber Attack After System Fault Causes Over 1,000 Flight Cancellations and Delays

Martin Rolfe, chief executive of National Air Traffic Services, ruled out a cyber attack as the cause of a major technical failure that disrupted UK airspace and led to more than 1,000 flight cancellations or significant delays in a single day. Rolfe said the organisation had ruled out a cyber incident at this stage of its investigation, with internal checks combined with input from relevant government agencies finding no evidence of external interference or unauthorised access to systems. Early indications instead point to a fault within the software that processes and validates flight plan data.

The outage caused widespread disruption at airports including Heathrow, Gatwick, Manchester and Stansted, leaving tens of thousands of passengers facing long queues, overnight stays in terminals and missed connections. Disruption was concentrated on short-haul European routes, though long-haul services were also affected as aircraft and crew were left out of position. Airlines warned that knock-on scheduling impacts would continue for several days.

The UK transport secretary has requested a comprehensive, independent review of the incident, to be carried out in coordination with the Civil Aviation Authority and other oversight bodies. The review is expected to examine system design, redundancy, data validation processes and the speed at which safe, degraded operational modes can be activated when primary systems fail. Industry estimates suggest airlines could collectively face costs running into tens of millions of pounds due to passenger care obligations, aircraft repositioning and lost revenue.

Under guidance from the UK Civil Aviation Authority, passengers affected by cancellations caused by extraordinary circumstances outside an airline's control — such as an air traffic control systems failure — are generally not entitled to statutory cash compensation, though airlines remain obliged to provide rebooking, meals and accommodation.

The incident has drawn comparisons to the January 2023 outage of the US Federal Aviation Administration's Notice to Air Missions system, in which investigators similarly found no evidence of a cyber attack and attributed the disruption to a corrupted data file.

This case belongs to a growing category of single-point-of-failure incidents in air traffic management, where a fault in one data validation layer cascades into a national-scale ground stop rather than staying contained to a single sector or airport. National air navigation service providers run centralised systems precisely because flight plan validation must be consistent across an entire airspace, but that same centralisation means a software defect can propagate faster than manual fallback procedures can absorb it.

The regulatory response — an independent review focused on redundancy, data validation and how quickly degraded modes can be activated — points to where the real vulnerability sits: not in perimeter security against external attackers, but in the resilience of the software pipeline itself once a fault occurs. The parallel drawn with the FAA's 2023 NOTAM outage reinforces that this is a recurring weakness across independently built systems rather than a one-off defect in a single provider's code.

What happens next depends on the independent review's findings on redundancy and failover speed, and on whether airlines' cost estimates for repositioning and passenger care are confirmed once schedules fully normalise.