European multinational aerospace corporation Airbus is investigating a possible cyber security incident after a threat actor published data allegedly stolen from the company.

The news of the cyber security incident came to light when cybercrime intelligence firm Hudson Rock reported that a threat actor, going by the name ‘USDoD’, claimed to have stolen data from the aerospace giant and posted it on a dark web forum named “Ransomed”.

“Ransomed is a relatively new ransomware group that is rapidly gaining prominence, proudly claiming on Twitter to have targeted a majority of companies with ransomware attacks during September 2023,” Hudson Rock said.

According to Hudson Rock’s report, “USDoD exposed the personal information of 3,200 sensitive Airbus vendors, with contact details such as names, addresses, phone numbers, and email addresses, all while claiming Lockheed Martin and Raytheon might be the next targets.”

As per screenshots shared by the cyber security company, the compromised data contains details of Airbus vendors including Rockwell Collins, Thales Group, and others. The hackers claimed that they infiltrated the systems of Airbus by compromising an account belonging to an employee at a Turkish airline.

Airbus confirmed to Hudson Rock that this was indeed the source of the cyber attack.

“We can confirm the match with our findings for that user account. Actions have been taken on this account to prevent further access. The other accounts listed on your platform have also been noted as similar actions will be performed on those users imminently,” Airbus CERT told the security company.

In a statement shared with Recorded Future News, Airbus spokesperson Philippe Gmerek said, “Immediate remedial and follow-up measures were taken by our security teams to prevent our systems from being compromised.”

Commenting on the news, Samantha Humphries, senior director of International Security Strategy at Exabeam, said, “Supply chain attacks are a breed of insider threat that all organisations need to be planning for, as they are often a much easier route for cybercriminals to penetrate or circumnavigate defences.

“Whilst the devil is in the contractual detail, realistically security leaders must play a part in due diligence discussions around supplier risk, but also implement processes and monitoring to ensure they can detect and respond to supply chain attacks. This is ultimately part of the cost of doing business, and should be seen as a business enabler, as well as a key focus from a risk and compliance perspective.

“Unfortunately, these types of attacks continue to be successful routes of income for adversaries, therefore proper preparation including table top exercises, credential monitoring, and breach response planning need to include third and fourth party supplier considerations,” Humphries added.