A new assessment of an earlier failure

The Cyber Monitoring Centre’s November 4 assessment estimates that September’s NATS air traffic control outage cost UK organisations about £33 million. Its model places the range at £24 million to £42 million and classifies the disruption in the lowest of its five impact categories. The estimate concerns an accidental software failure on September 8, not a newly discovered cyberattack. More than three quarters of the modelled financial impact fell on airlines, while NATS itself accounted for less than £1 million.

The assumptions matter

The CMC estimate covers UK-resident organisations and uses information available through October 30. Rebooking assumptions materially change the result: the central case assumes 70 percent of passengers on cancelled flights rebooked. The assessment excludes future resilience investment and reputational effects. Those boundaries make the figure a modelled loss estimate, rather than a final accounting of every cost.

Restoring the system did not restore the schedule

NATS’ September 18 preliminary account traced the incident to code that allocates aircraft identification codes. A higher-priority message interrupted a request; when processing resumed, a software defect produced corrupted output affecting subsequent flight-data updates. NATS said restrictions protected safety while the system was restarted and flight data reloaded. Operations returned to normal that evening, but clearing passenger disruption took more than two days. The distinction matters for transport operators: a technical recovery timestamp does not measure the time needed to reposition aircraft, crews or customers.

The review now needs operational evidence

The Civil Aviation Authority opened a call for input on November 3, asking airlines, airports and representative groups to describe the incident’s operational effects and lessons for resilience. It closes at 11:59 p.m. on November 23. The regulator says the review cannot adjudicate individual passenger complaints or compensation claims. Its published terms include system renewal, business continuity and the implementation of recommendations from earlier reviews; the final report is due by March 8, 2027.

A wider basis for the investment decision

For security and continuity leaders, the combined record exposes a measurement problem: the organisation fixing the failed technology may bear only a small share of the interruption’s business consequences. A resilience case based solely on the operator’s own lost revenue can therefore miss the costs borne by dependent businesses. The ongoing review offers a concrete opportunity to connect technical restoration, reduced operating capacity and downstream recovery in one evidence base.

Sources & further reading

Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.

Transportation
Suggest a correction →