The disruptions over the weekend at several major European airports were caused by a ransomware attack targeting the check-in and boarding systems.

Among the airports suffering technical difficulties are Heathrow in London, Brussels Airport, and Brandenburg in Berlin. Cork and Dublin airports in Ireland also experienced difficulties, but the impact was minor.

The attack started on Friday night, according to Brussels Airport, and targeted “Collins Aerospace, the external provider of check-in and boarding systems.”

Hackers targeted the MUSE (Multi-User System Environment) system, which is used by multiple airlines to share check-in desks and boarding gate positions, as a solution to having their own dedicated infrastructure.

“Following a cyberattack on the American company Collins Aerospace, the external provider of check-in and boarding systems, there are disruptions to check-in operations at several European airports,” Brussels Airport says on its website.

Ransomware attack confirmed

The European Union Agency for Cybersecurity (ENISA) told The Guardian in a statement on Monday that a ransomware attack caused the disruptions.

The incident impacted a significant number of flights, as more than 100were either delayed or cancelled, and thousands of passengers had to be processed manually.

Brussels Airport said that disruptions continued on Monday and advised passengers to check the status of their flight before coming to the airport.

Collins Aerospace has been working to restore the system as soon as possible at impacted airports.

Law enforcement is also involved in the investigation, according to a spokesperson for the National Cyber Security Centre (NCSC) in the U.K.

“We are working with Collins Aerospace and affected UK airports, alongside Department for Transport and law enforcement colleagues, to fully understand the impact of an incident,” the NCSC states.

The agency is urging all organizations to turn to its free guidance, services, and tools to improve their security stance and reduce the risk of a cyberattack.