NATS Outage Cost UK Economy Up to £42m, CMC Report Finds

A single IT failure at National Air Traffic Services (NATS) last September cost the UK economy around £33m ($44m), and possibly as much as £42m ($56.6m), according to a report published on November 4 by the Cyber Monitoring Centre (CMC). The bill for 70 domestic organizations covers 1,152 flight cancellations plus significant delays and diversions.

The number climbs higher once you widen the frame. Include overseas airlines and the cost may have reached £76m ($102.4m) on roughly 1,800 cancelled flights. The CMC did not assess the impact on other non-UK organizations. An estimated 450,000 passengers were affected by cancellations or delays of more than two hours.

Was it a cyberattack?

No. The CMC confirmed the incident was not malicious, but that distinction did little to soften the fallout. The report drew a direct parallel with a familiar comparator: "Like the CrowdStrike software failure in 2024, it nonetheless shows how a failure in a single critical technology can cause widespread disruption to UK organisations."

The report's central point is about where the losses landed. "Its significance lies less in the scale of loss than in what it shows about the aviation system: a brief outage in a single critical system disrupted airline schedules for several days, and almost all of the cost fell on airlines and other organizations rather than on NATS."

What actually broke?

The root cause was a "previously unknown defect in the legacy software of the National Airspace System (NAS)." A routine request for an aircraft identification code and a higher-priority system message collided within about one millisecond.

The timeline tightened fast. Corrupted flight data first appeared at 10am. By 12:45pm, all UK departures were stopped. At 1.32pm, after losing an automated system link, NATS declared a major incident and moved to manual fallback procedures, including major traffic restrictions.

The flight data system itself was restored within three-and-a-half hours. But flight restrictions were not lifted until the evening, and the impact on travellers lasted much longer.

Does the new legislation fix this?

Not really, according to the CMC. NATS is already mandated under the NIS Regulations 2018 to meet specific security and resilience obligations, and the CMC found nothing in the new Cyber Security and Resilience Bill that would prevent a similar incident in the future. The new regime may, however, improve how incidents are reported and overseen.

The CMC recommended that the aviation industry take three steps:

• Review how well coordination between NATS, airlines and airports worked during the downtime.
• Examine whether earlier and more frequent assessments of expected outage duration would have helped airlines and airports limit disruption more effectively than waiting for certainty.
• Plan for a "multi-hour restriction in air traffic capacity," including scenarios that last much longer than the outage itself.

CMC technical committee chair Ciaran Martin said: "Organizations need to understand and plan for the risks that sit in systems they depend on, not just the systems they own."

The CMC warned that the risk of outages stemming from unidentified software defects "is heightened while NATS continues to rely on legacy systems" — a signal that until that software base is modernized, UK carriers and airports remain exposed to a repeat.