Nats outage cost UK economy £33 million, airlines bore most of it

A one-millisecond fault in UK air traffic control software on 8 September cost the UK economy an estimated £33 million and forced the cancellation of more than 2,000 flights. The Cyber Monitoring Centre (CMC), a non-profit organisation, published the figure on Wednesday in its assessment of the failure at National Air Traffic Services (Nats), which disrupted travel for hundreds of thousands of passengers.

Airlines absorbed more than three-quarters of the financial impact. By contrast, the CMC estimated that Nats itself lost less than £1 million in route charges on cancelled flights. The £33 million covers costs to UK airlines, airports, ground operators and tour operators from cancellations, delays and diversions.

What does the outage change for carriers and infrastructure operators?

The cost distribution is the report's central finding. When losses to overseas airlines are included, the CMC put total financial damage at between £48 million and £76 million. That figure excludes harm to non-UK organisations, including foreign airports.

The CMC also assumed no material external incident response or system rebuild costs, because Nats' in-house staff carried out the response and the fix. The cost of Nats' internal investigation and any future investment in resilience are not included in the estimates.

Nats said the fault occurred in "the space of a millisecond". Flights to and from the UK were axed as a result, and disruption continued into the day after the initial failure.

Was it a cyber attack?

No. The CMC classified the incident in the lowest impact category on its five-point scale. It attributed the failure to a "previously unknown defect in legacy software" and stated the event "was not malicious".

Ciaran Martin, chairman of the CMC technical committee, was direct on the point. "This was an accidental technology failure, not a cyber attack, and safety was maintained throughout," he said. "But like the CrowdStrike outage in 2024, it shows how a fault in a single system can spread disruption and cost across the organisations that depend on it."

Martin drew out the governance implication for dependent operators. "Of an estimated £33 million in UK losses, Nats bore less than £1 million, with most of the impact falling on airlines," he said. "Organisations need to understand and plan for the risks that sit in systems they depend on, not just the systems they own."

What did the official reviews find?

Nats produced a preliminary report into the 8 September failure. It concluded the issue stemmed from a software problem rather than "any incorrect actions" by controllers.

A second, unrelated air traffic issue followed less than a fortnight later. That problem caused further disruption and led to more than 170 additional flight cancellations.

The back-to-back failures triggered political and commercial pressure on Nats leadership. Chief executive Martin Rolfe resisted calls to resign after both incidents. Ryanair was among those demanding his departure.

Nats declined to engage with the CMC's findings directly. A spokesperson said: "We have noted the Cyber Monitoring Centre's statement. We will not be commenting on its contents; the CAA is conducting an independent review of the incident on September 8."

The Civil Aviation Authority's review, still under way, is likely to determine whether the resilience investment excluded from the CMC's cost estimate becomes a regulatory obligation — and who ultimately pays for it.