A major IT failure at the UK’s National Air Traffic Services (NATS) in September was not caused by a cyber incident, but still cost the economy tens of millions of pounds, a new report has revealed.

The Cyber Monitoring Centre (CMC) claimed in a report published on November 4 that the cost to the UK economy was around £33m ($44m), with 70 domestic organizations affected.

However, it may have reached as high as £42m ($56.6m), according to the CMC’s modelled range, which reflects the cost to UK airlines, airports, ground operations and tour operators of 1152 flight cancellations, alongside significant delays and diversions.

If the impact on overseas airlines is included, the cost may have reached as high as £76m ($102.4m) based on 1800 cancelled flights. The impact on other non-UK organizations was not assessed.

The CMC estimated that 450,000 passengers were affected by cancellations or delays of more than two hours.

Read more on IT outages: CrowdStrike Fault Causes Global IT Outages.

Although not the result of a malicious attack, the incident highlights the ongoing challenge of improving business and IT resilience in critical sectors.

“Like the CrowdStrike software failure in 2024, it nonetheless shows how a failure in a single critical technology can cause widespread disruption to UK organisations,” the report noted.

“Its significance lies less in the scale of loss than in what it shows about the aviation system: a brief outage in a single critical system disrupted airline schedules for several days, and almost all of the cost fell on airlines and other organizations rather than on NATS.”

NATS is already mandated by the existing NIS Regulations 2018 to meet specific security and resilience obligations, and there’s nothing in the new Cyber Security and Resilience Bill that would help to prevent a similar incident in the future, the CMC claimed.

However, the new regime may improve how incidents are reported and overseen, it noted.

Some Lessons Learned

The outage itself was caused by a “previously unknown defect in the legacy software of the National Airspace System (NAS),” when a “routine request for an aircraft identification code and a higher-priority system message collided within about one millisecond,” the CMC said.

Corrupted flight data first appeared at 10am, and at 12:45pm all UK departures were stopped. Following the loss of an automated system link at 1.32pm, NATS declared a major incident and moved to manual fallback procedures, including major traffic restrictions.

Although the flight data system was restored within three-and-a-half hours, flight restrictions weren’t lifted until the evening and the impact on travellers lasted much longer.

CMC recommended the aviation industry to:

• Review how well coordination between NATS, airlines and airports worked during the downtime
• Examine whether earlier and more frequent assessments of expected outage duration would have helped airlines and airports to limit disruption more effectively than waiting for certainty
• Plan for a “multi-hour restriction in air traffic capacity” that includes scenarios which last much longer than the outage itself

CMC technical committee chair, Ciaran Martin said: “Organizations need to understand and plan for the risks that sit in systems they depend on, not just the systems they own.”

The CMC warned that the risk of outages stemming from unidentified software defects “is heightened while NATS continues to rely on legacy systems.”