Canada-based aircraft manufacturer Bombardier revealed on February 23 that it had suffered breach , with some of data on a dark web portal operated by the Clop ransomware gang.
The company said in a statement: "In an initial investigation, we discovered that an unauthorized party was accessing and stealing data, exploiting a vulnerability affecting a third-party application , which runs on servers on Bombardier's main IT network."
Although the company did not specifically name the device, it is likely referring to the Accellion FTA, a web server that can be used by companies to host and share large files that cannot be emailed to customers and employees. As ZDNet reports, last December, a hacking group discovered a zero-day vulnerability in the FTA software and began attacking companies around the world. The attackers took over systems, installed a web shell , and then stole sensitive and confidential data.
Accellion issued a press release on February 23rd stating that 300 of its customers running FTA servers were hacked, 100 were compromised , and 25 more were further impacted as their data was stolen. The attackers then blackmailed the compromised companies, telling them that they would leak the stolen data if they refused to pay the ransom.
Earlier this month, data from some old Accellion customers began leaking to a dark web data leak site, where the Clop ransomware gang typically "exposes" companies that refuse to pay ransoms.
In addition to the Bombardier data published on February 23 on the site, data has so far been leaked concerning the geospatial data company “Fugro”, the technology company “Danaher”, Singapore’s largest telecommunications company “Singtel” and the American law firm “Jones Day”.
The data shared on the site includes design documents for various Bombardier planes and aircraft parts. Additionally, while no personal data was shared, the planemaker is concerned that some of its private intellectual property is now being offered for free on the dark web.
