The Canadian airplane manufacturer has today revealed that it suffered a security breach. In a press release, Bombardier disclosed that some of its data has been published on the dark web portal operated by the Clop ransomware gang: “An initial investigation revealed that an unauthorized party accessed and extracted data by exploiting a vulnerability affecting a third-party file-transfer application, which was running on purpose-built servers isolated from the main Bombardier IT network.”
In December 2020 a zero-day attack in the Accellion FTA software was discovered by a hacking group, who exploited the vulnerability to steal sensitive data. It has been confirmed by Accellion that 300 of its customers were running this software, 100 of which got attacked and 25 of which had data stolen; Bombadier was added to the list on Monday. Bombardier has said that data leaked on the site does not include personal data, however design documents for various Bombardier airplanes and plane parts have been shared. As a result some of the manufacturer’s private intellectual property is being offered as a free download on the dark web.
