ESA Confirms Breach of External Servers

The European Space Agency confirmed on Thursday that a cybersecurity incident compromised a limited number of external servers used for unclassified scientific collaboration, following claims by a hacker who said they stole 200 gigabytes of data from the organization in mid-December.

The breach occurred on December 18, according to the threat actor known online as 888, who posted details on a cybercrime forum and offered the data for sale exclusively in the cryptocurrency Monero. The hacker provided screenshots as evidence, alleging access to private repositories and the exfiltration of sensitive files over approximately one week. ESA officials stated that the affected systems were hosted outside the agency's core corporate network and supported collaborative engineering work with external partners and the scientific community. Initial forensic analysis indicated no impact on classified systems or the main internal environment, and the agency has implemented containment measures to secure potentially affected devices.

Among the materials the hacker claimed to have obtained were source code from private Bitbucket repositories, API and access tokens, configuration files, hardcoded...