NATS Air Traffic Control Software Failure Cost UK Economy up to £76m
A September National Air Traffic Services (NATS) IT failure, caused by a software defect rather than a cyber attack, cost the UK economy an estimated £33m ($44m), according to a Cyber Monitoring Centre (CMC) report published November 4. The incident affected 70 domestic organizations, triggered 1,152 flight cancellations, and disrupted around 450,000 passengers through cancellations or delays exceeding two hours. Including impacts on overseas airlines, the total cost could reach as high as £76m ($102.4m) across 1,800 cancelled flights. The CMC compared the event to the 2024 CrowdStrike outage, noting that a single critical system failure caused disproportionate downstream disruption, with most costs falling on airlines and other organizations rather than NATS itself.
Detalhes técnicos
The outage stemmed from a previously unknown defect in the legacy software of the National Airspace System (NAS). A routine request for an aircraft identification code collided with a higher-priority system message within about one millisecond, corrupting flight data. Corrupted data first appeared at 10:00, all UK departures were halted by 12:45, and after an automated system link failure at 13:32, NATS declared a major incident and reverted to manual fallback procedures with major traffic restrictions. The flight data system was restored within three-and-a-half hours, but restrictions remained until the evening, with traveler impact lasting far longer.
Remediação
The CMC recommended the aviation industry review coordination between NATS, airlines, and airports during outages; assess whether earlier estimates of outage duration could reduce disruption; and plan for multi-hour air traffic capacity restrictions, including scenarios lasting longer than the outage itself. The report noted that NATS is already bound by NIS Regulations 2018 resilience obligations, and that the forthcoming Cyber Security and Resilience Bill would not have prevented this incident, though it may improve incident reporting and oversight. The CMC warned that risk from undiscovered software defects remains elevated while NATS continues relying on legacy systems.
Linha do tempo
-
NATS Air Traffic Control Software Failure Cost UK Economy up to £76m
ler a análise desta fonte ocultar
A September National Air Traffic Services (NATS) IT failure, caused by a software defect rather than a cyber attack, cost the UK economy an estimated £33m ($44m), according to a Cyber Monitoring Centre (CMC) report published November 4. The incident affected 70 domestic organizations, triggered 1,152 flight cancellations, and disrupted around 450,000 passengers through cancellations or delays exceeding two hours. Including impacts on overseas airlines, the total cost could reach as high as £76m ($102.4m) across 1,800 cancelled flights. The CMC compared the event to the 2024 CrowdStrike outage, noting that a single critical system failure caused disproportionate downstream disruption, with most costs falling on airlines and other organizations rather than NATS itself.
Technical Details
The outage stemmed from a previously unknown defect in the legacy software of the National Airspace System (NAS). A routine request for an aircraft identification code collided with a higher-priority system message within about one millisecond, corrupting flight data. Corrupted data first appeared at 10:00, all UK departures were halted by 12:45, and after an automated system link failure at 13:32, NATS declared a major incident and reverted to manual fallback procedures with major traffic restrictions. The flight data system was restored within three-and-a-half hours, but restrictions remained until the evening, with traveler impact lasting far longer.
Remediation
The CMC recommended the aviation industry review coordination between NATS, airlines, and airports during outages; assess whether earlier estimates of outage duration could reduce disruption; and plan for multi-hour air traffic capacity restrictions, including scenarios lasting longer than the outage itself. The report noted that NATS is already bound by NIS Regulations 2018 resilience obligations, and that the forthcoming Cyber Security and Resilience Bill would not have prevented this incident, though it may improve incident reporting and oversight. The CMC warned that risk from undiscovered software defects remains elevated while NATS continues relying on legacy systems.