The Cyber Monitoring Centre (CMC) has categorised the accidental disruption to UK air traffic control services provided by NATS on 8 September 2026 as a Category 1 event on the five-point CMC scale, where 1 is the lowest impact and 5 is the highest impact. The incident was caused by a previously unknown defect in legacy software and was not malicious.
The CMC model estimates the event caused a UK financial impact of about £33 million and affected more than 70 UK organisations. The modelled range of loss is £24 million to £42 million. This estimate reflects the cost to UK airlines, airports, ground operations and tour operators of 1,152 flight cancellations, together with significant delays and diversions. The estimate is sensitive to key assumptions, including the proportion of passengers able to rebook onto alternative flights; this and other assumptions and limitations are discussed later in this document.
Including the impact to overseas airlines, the CMC model estimates the financial impact for the event as £48 million to £76 million based on a total number of 1,800 cancelled flights. This does not include losses to other non-UK organisations including airports.
Although the system outage itself was resolved the same day, disruption to airline schedules continued until 11 September. Over three quarters of the financial impact fell on airlines, with comparatively little falling on NATS, the organisation where the failure occurred.
Event Overview and Categorisation
On Tuesday 8 September 2026, a previously unknown defect in the legacy software of the National Airspace System (NAS), the flight data processing platform used by NATS, caused major disruption to UK air traffic control. Corrupted flight data first arose at approximately 10:00 and, at approximately 12:45, all UK departures were stopped. Following the loss of an automated system link at 13:32, controllers at the NATS Swanwick Centre declared a major incident and moved to manual fallback procedures. To preserve safety margins, NATS imposed traffic restrictions, including, from 13:38, capping entry to London sectors at 30 aircraft per hour. A controlled restart of the flight data system was completed at 16:09, and all restrictions were lifted at 19:30 once flight data across systems had been reconciled. The NATS preliminary investigation report, produced on 16 September, found that the defect was triggered when a routine request for an aircraft identification code and a higher-priority system message collided within about one millisecond. NATS has stated that there is no evidence of malicious or cyber-related activity, and no controller or operator error.
NATS handled just over 6,000 of the 8,000 flights forecast that day. The CMC analyses data from our partner Cirium, which provides flight level data on cancellations, delays and diversions. This data identifies 1,800 cancellations attributable to the event (1,152 for UK airlines), after adjusting for normal daily levels of cancellations. Over 800 further flights were delayed by more than two hours and 60 were diverted, with the effects continuing until 11 September as airlines worked to return aircraft and crew to the right locations. Heathrow, Gatwick, Manchester and Stansted were the worst affected airports. The CMC estimates that 450,000 passengers were affected by cancellations or delays of more than two hours. The Transport Secretary has asked the Civil Aviation Authority (CAA) to carry out an independent review of NATS’ findings and resilience investment plans, with a final report due by 8 March 2027. NATS’ own Major Incident Investigation is in progress. A separate connectivity failure at NATS’ Prestwick centre on 21 September caused further cancellations; NATS has stated that it is unrelated to the 8 September defect and therefore is not included in this analysis.
The CMC assesses accidental disruptions as well as the impact of malicious cyber attacks. The CMC has categorised the NATS incident as a Category 1 event, based on the CMC matrix. The incident meets the Category 1 criteria based on a financial loss of between £10 million and £100 million to the UK operations of organisations, and a material financial impact to fewer than 270 UK organisations. The CMC’s analysis covers only the impact on UK-resident organisations, including UK subsidiaries of foreign-owned airline groups, consistent with the residence basis used in the UK national accounts. The event had a wider impact, affecting foreign airlines and the operations of overseas airports, and these losses are not included. Of the 1,800 cancellations attributed to the event, more than a third were flights operated by non-UK airlines.
The human impact of this event is also notable. While safety was not compromised, the event caused considerable disruption to passengers. People missed connections, spent nights in airports, endured long waits on board aircraft and some missed important meetings, events or family gatherings. Airport and airline staff worked additional hours to support passengers and recover schedules, and in some cases faced abuse from frustrated passengers.
The Cyber Monitoring Matrix Showing the Positioning of this Event
Financial Loss Analysis
The CMC modelled loss for the event is about £33 million, with a range of £24 million to £42 million. This estimate is based on the information available as of 30 October 2026. It is the view of the CMC’s Technical Committee that this represents a credible assessment of the event’s financial loss. The CMC’s assessment draws on publicly available data including the NATS preliminary investigation report, published airport charges, airline financial data and aviation sector benchmarks. The CMC also analyses data from one of our data partners Cirium, along with insights shared by industry experts and those impacted by the event. The estimate is for the impact of the event to UK-resident organisations, on the basis described above; losses incurred by non-UK-resident airlines, including on their flights to and from UK airports, are not included in the analysis.
The modelled number is sensitive to the input parameters, most notably the proportion of passengers on cancelled flights who were able to rebook, the average fare by flight distance, and the average number of passengers per flight. For example, if 80% of passengers had been able to rebook, rather than the 70% assumed, the modelled loss would fall to just over £24 million; at 60%, it would rise to just over £42 million.
The major components of the analysis are:
1. NATS losses: The air traffic control charges lost by NATS on cancelled flights.
NATS is estimated to have lost less than £1 million in route charges on the 1,800 cancelled flights. The incident response and system fix were carried out by NATS’ in-house staff, so no material external incident response or system rebuild costs have been assumed. The cost of NATS’ internal investigation and any future investment in resilience are not included.
2. Airline losses: The lost revenue and additional costs incurred by UK airlines as a result of cancelled, delayed and diverted flights minus any savings due to unpaid variable costs, most notably fuel costs for cancelled flights.
Airlines account for just over £24 million of the modelled loss. Cancellations are the largest driver at over £18 million, reflecting lost fares on 1,152 excess flights cancelled by UK airlines, lost ancillary revenue, and the cost of crew and hotels for stranded passengers. The CMC has assumed that 70% of passengers on cancelled flights were able to rebook, based on previous airline reporting and survey data.
Delays of more than two hours added close to £2.5 million, primarily from additional fuel and crew costs together with duty of care costs such as food, water and hotels. Diversions and costs associated with repositioning aircraft added close to £4 million. The CAA has indicated that the disruption is likely to constitute ‘extraordinary circumstances’, meaning statutory passenger compensation is not expected to be payable, although airlines’ duty of care obligations remain.
3. Losses to other organisations: The charges, fees and bookings lost by UK airports, ground operations providers and tour operators as a result of cancelled flights.
Other organisations account for the remainder of the modelled loss, around £8 million in total, mainly from passenger and aircraft movement charges lost by airports and hotel bookings that package holiday customers were unable to use. These estimates are based on more limited data than those for airlines and NATS, and are subject to greater uncertainty.
The analysis does not include the cost of the CAA independent review, any future investment by NATS in resilience, reputational impact to any of the impacted organisations and any wider effect on inbound tourism. The impact on air cargo was found to be negligible, as most cargo flights operate overnight. Potential claims under travel insurance policies have also not been included.
The modelled loss is broadly consistent with comparable historical events, although their scope and methods differ. The NATS flight planning system failure of August 2023, which caused a slightly greater number of cancellations, was estimated by the CAA Independent Review Panel to have cost £75 million to £100 million, of which approximately £65 million fell on airlines. The event had a slightly larger number of cancellations and we believe the financial estimate included non-UK airlines but did not include fuel savings on cancelled flights. Adjusting for these factors leads to a comparable total event loss.
The CMC rating of an event is based on the information available to us in the weeks following an event. We will learn more as NATS’ Major Incident Investigation and the CAA independent review are completed.
Observations arising from this event
Following its assessment, the Technical Committee have made the following general observations:
-
- Not a malicious event: This incident was caused by an accidental technology failure and was not malicious; there is no evidence of cyber-related activity. Like the CrowdStrike software failure in 2024, it nonetheless shows how a failure in a single critical technology can cause widespread disruption to UK organisations.
-
- A disruptive event, not a safety event: NATS maintained the safe separation of aircraft throughout, and the traffic restrictions it imposed were a deliberate measure to preserve safety margins. The safety measures worked as intended, but at the cost of significantly reduced capacity, so the impact of the event was disruption rather than risk to life.
-
- Short-lived, but with cascading economic impact: The outage was short-lived, with the flight data system restored within three and a half hours and all restrictions lifted the same evening. However, as a disruptive event it caused financial losses to many parties and considerable upheaval, both to travelling passengers and to people working in a range of functions across the aviation sector.
-
- Costs fall away from where the failure occurs: An outage in air traffic control leads to costs being incurred predominantly by others in the system, mainly airlines. In our analysis of this event, NATS bore less than £1 million of the £33 million loss. This raises a question about how the wider economic consequences of an outage are reflected when resilience requirements and investment priorities are set, which the CAA may wish to consider in its independent review.
-
- Knock-on effects through a complex system: The outage illustrates the complexity of knock-on effects through the aviation system. A disruption of a few hours on a single afternoon affected schedules for four days, as aircraft and crew had to be returned to the right locations, and displaced passengers had to be rebooked. A longer outage would have caused far greater knock-on impacts. This is a reminder to policymakers that, in a tightly interdependent system operating close to capacity, the effects of a failure in a key system can persist long after the technical fault has been resolved.
-
- Legacy technology: The immediate cause of this outage was a defect in the system’s processing logic that sat undetected since the system was developed. NATS has now deployed a permanent fix, but a replacement flight data processing platform is not expected for a number of years. Until then, the UK remains reliant on the existing system, with the ongoing risk that further problems will surface. Legacy systems are a risk to resilience because they affect how quickly such defects can be diagnosed and resolved, and often depend on scarce, specialist skills and close supplier support. Legacy systems do, however, have well understood behaviour and a mature codebase, whereas transitioning to a new system can introduce new, undiscovered software defects.
Recommendations arising from this event
The Technical Committee have the following recommendations for NATS, airlines, airports and other interested parties:
-
- Review how existing coordination arrangements performed during this outage: The aviation system is large, complex and highly interdependent. Existing industry forums, together with the recommendations of the independent review of the August 2023 failure, already address coordination between NATS, airlines and airports. This event provides an opportunity to reflect on progress against the 2023 review panel’s recommendations and consider if any additional coordination is needed to help manage downtime events.
-
- Examine the scope to provide earlier and more frequent assessments of the expected outage duration to airlines and airports: During an outage, the most valuable information for airlines and airports is how long it is likely to last. An airline expecting one hour of disruption will make very different decisions from one expecting three hours, including whether to hold or cancel flights, where to position aircraft and crew, and how to look after passengers. Building on the earlier-notification measures adopted after the 2023 review, NATS could review its communication during the event, including whether it is possible to provide more frequent updates on its best current estimate of when normal service will resume, even where that estimate is uncertain and may later need to change. Early, regularly updated information allows the industry to limit disruption more effectively than waiting for certainty.
-
- Plan for further outages across the whole sector: Outages from previously unidentified software defects are possible with any system, and the risk is heightened while NATS continues to rely on legacy systems, including through the eventual transition to their replacement. Airlines and airports should plan for a multi-hour restriction in air traffic capacity, including recovery of aircraft and crew positioning and care for displaced passengers. That planning should also include scenarios that last much longer, not just the duration of the outage itself.
Looking ahead: the Cyber Security and Resilience Bill
The Cyber Security and Resilience (Network and Information Systems) Bill is still completing its passage through Parliament, and its final text is not yet settled. Royal Assent is anticipated in early 2027, although the timetable is not confirmed, with most new duties then brought into effect in phases through secondary legislation. The Bill amends, rather than replaces, the Network and Information Systems Regulations 2018 (NIS Regulations), under which NATS is already regulated as an operator of essential services, with the Secretary of State for Transport and the CAA acting jointly as the competent authority for aviation. NATS is therefore already subject to security and resilience obligations. The Bill does not introduce a fundamentally different resilience regime for air traffic control, although it would strengthen incident reporting and regulatory oversight, and create powers through which further requirements could be introduced in future.
The most relevant changes concern incident reporting. Regulated organisations would be required to make an initial notification within 24 hours of becoming aware of a reportable incident, followed by a full report within 72 hours, with both sent to the National Cyber Security Centre (NCSC), in its role as the UK’s national computer security incident response team (CSIRT), at the same time as the regulator. The definition of a reportable incident would also be widened to include incidents likely to have a significant impact, not only those that have already caused disruption. The NIS regime is concerned with the resilience of network and information systems as well as with cyber attacks, so a non-malicious technology failure of this kind is likely to remain within scope. The Bill would also strengthen regulators’ enforcement powers and allow suppliers that are critical to essential services to be designated and regulated directly.
Although the Bill covers NATS, it is a general piece of legislation covering UK critical infrastructure as a whole, and it is not designed to address every detail of what went wrong in this specific case. The NIS regime requires operators of essential services to take appropriate and proportionate measures to manage risks to their systems and to minimise the impact of incidents overseen by the appropriate authority, in this case the CAA.
Conclusion
The CMC’s analysis aims to bring transparency to major incidents affecting UK organisations, setting out their financial impact and where that impact falls. This was a short-lived, non-malicious technology failure with a relatively contained financial impact. Its significance lies less in the scale of loss than in what it shows about the aviation system: a brief outage in a single critical system disrupted airline schedules for several days, and almost all of the cost fell on airlines and other organisations rather than on NATS.
The CMC will continue to work with affected organisations, data providers, insurers, and government partners to understand the impact of the event and share lessons learned, and hopes that its findings will be of use to the CAA’s independent review.
About the Cyber Monitoring Centre
The Cyber Monitoring Centre is an independent, non-profit organisation responsible for analysing and categorising cyber events that impact UK organisations.
Events are categorised by an independent technical committee made up of leading cyber experts and based on analyses of data from leading providers. Event categorisation and event reports are made publicly available to help increase the understanding of the impact of cyber events and improve cyber mitigation and response plans. Detailed CMC analysis and data are provided to CMC Members.
Full details of the CMC’s methodology and categorisation matrix can be found here and full details of the CMC’s Technical Committee can be found here.
Disclaimer
The Cyber Monitoring Centre provides event categorisations free of charge that are publicly available to all. No liability is accepted for the use of, or reliance on event categories. Event categorisations are determined based on the information available. All reasonable endeavours are used to try to ensure accuracy of the information used in providing the event categorisation. However, the Cyber Monitoring Centre makes no representations or warranties of any kind, whether express or implied, as to the completeness, accuracy, reliability or suitability of the event categorisation or any supporting information, any of which may be subject to change without notice.