British police have arrested a man in connection with the ransomware attack that recently threw travel across Europe into chaos.

The suspect, said to be in his 40s, was taken into custody on Tuesday under the Computer Misuse Act. Authorities believe he may have been involved in the cyberattack that targeted Collins Aerospace, a subsidiary of RTX (formerly Raytheon). That hack crippled airport check-in systems, leading to delays, cancellations, and headaches for thousands of passengers. He’s since been released on conditional bail while investigations continue.

The UK’s National Crime Agency (NCA) stressed that this is still very much an active case. “Although this arrest is a positive step, the investigation into this incident is in its early stages and remains ongoing,” said NCA Deputy Director Paul Foster.

For now, investigators haven’t confirmed which criminal group carried out the attack. Typically, ransomware gangs announce their hacks on dark web sites and sometimes leak stolen data, but so far, no group has claimed responsibility for this one.

Ransomware works by locking up a company’s systems and demanding payment for their release. While some gangs prefer to avoid high-profile targets that could draw heavy law enforcement scrutiny, this incident shows how attacks on critical systems can have real-world consequences.

The Collins Aerospace hack is just one of several major cyber incidents hitting Europe this month. Jaguar Land Rover, Britain’s biggest carmaker, has had to extend factory closures until October 1 after a separate cyberattack brought its operations to a halt. And in Germany, Berlin Airport said it may take several more days before its software is secure and fully operational again after being caught up in the Collins Aerospace fallout. Photo by B_A, Wikimedia commons.