“Organizations need to understand and plan for the risks that sit in systems they depend on, not just the systems they own.”
The technical fault: a millisecond collision in legacy software
A Cyber Monitoring Centre (CMC) report published on November 4 finds that the September outage at the UK’s National Air Traffic Services (NATS) was not the result of a cyber incident. Instead, the CMC traced the failure to “a previously unknown defect in the legacy software of the National Airspace System (NAS),” where “a routine request for an aircraft identification code and a higher-priority system message collided within about one millisecond.”
Corrupted flight data first appeared at 10:00am. By 12:45pm all UK departures had been stopped. After an automated system link was lost at 1:32pm, NATS declared a major incident and moved to manual fallback procedures, including substantial traffic restrictions. The flight data system was restored within three-and-a-half hours, but restrictions were not lifted until the evening and the disruption to travellers persisted beyond that day.
Economic damage: tens of millions in cancelled flights and delays
The CMC’s economic model attributes roughly £33m ($44m) in cost to the UK economy, affecting 70 domestic organisations. That figure reflects disruption across UK airlines, airports, ground operations and tour operators from 1,152 flight cancellations, together with considerable delays and diversions.
The CMC’s modelled range places the domestic cost up to £42m ($56.6m). If the analysis includes overseas airlines, the maximum modelled impact rises to £76m ($102.4m) based on 1,800 cancelled flights. The report estimated about 450,000 passengers experienced cancellations or delays exceeding two hours. The CMC did not assess the impact on other non‑UK organisations beyond overseas airlines.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildOperational response and where the cost landed
The report highlights that, although the outage was brief in technical terms, its operational effects extended far longer. The CMC observed that “a brief outage in a single critical system disrupted airline schedules for several days, and almost all of the cost fell on airlines and other organizations rather than on NATS.”
Once NATS moved to manual fallbacks and traffic restrictions, airlines, airports and ground operators had to manage cancellations, reroutes and passenger care. The CMC suggests that earlier, more granular estimates of expected outage duration might have allowed those organisations to limit disruption more effectively than waiting for certainty.
CMC recommendations for aviation coordination and resilience
- Review how well coordination between NATS, airlines and airports worked during the downtime.
- Examine whether earlier and more frequent assessments of expected outage duration would have helped airlines and airports to limit disruption more effectively than waiting for certainty.
- Plan for a “multi‑hour restriction in air traffic capacity” that includes scenarios which last much longer than the outage itself.
The CMC also warned that the risk of outages from unidentified software defects “is heightened while NATS continues to rely on legacy systems.” The report drew an explicit parallel to a prior operational technology failure, noting: “Like the CrowdStrike software failure in 2024, it nonetheless shows how a failure in a single critical technology can cause widespread disruption to UK organisations.”
What this means for UK airlines, airports and NATS
UK airlines and airports will be focused on improving contingency planning for multi‑hour capacity restrictions and on processes that convert an early technical signal into operational decisions. The CMC recommended more frequent assessments of expected outage duration — action that primarily affects airline and airport operations teams responsible for cancellations, passenger care and crew rostering.
NATS faces attention on its continued reliance on legacy NAS components. The CMC emphasised that unidentified defects in legacy systems heighten outage risk and that NATS is already subject to security and resilience obligations under the NIS Regulations 2018. The CMC also noted the new Cyber Security and Resilience Bill would not prevent a similar fault but might improve incident reporting and oversight under the emerging regime.
Conclusion
The CMC’s account frames the September incident as a reminder that non‑malicious software defects in a single critical system can cascade into multi‑day operational and economic consequences. About 450,000 passengers were caught up in delays or cancellations, and costs modelled by the CMC ran from about £33m to as much as £76m when overseas carriers are included. The concrete next steps set out in the report—coordination reviews, faster outage-duration assessments and planning for prolonged capacity restrictions—point to changes that sit with airlines, airports and NATS rather than with a single vendor or a new piece of legislation.
https://www.infosecurity-magazine.com/news/nats-air-traffic-control-fail-cost/
