An attacker claiming to have obtained unauthorized access to the ESA’s internal network has indicated they will sell ESA’s data online. According to the ESA, this breach presents a serious risk of damage to their systems, demonstrates the increased sophistication of cyber attacks on prominent organizations, and presents a major concern regarding cybersecurity risks to space systems. Although the ESA does not report the type of data that was breached, the hacker indicates he stole many types of confidential ESA data, including internal documents, user names, passwords, and project-related data.
The hacker spent a considerable amount of time in the system
In addition, the hacker states that he had been inside the ESA system for a considerable amount of time before the detection of his activities. It appears the hacker may have employed an Advanced Persistent Threat (APT) technique to remain undetected until he decided to leave the system.
An APT allows hackers to gain entry into a computer system and remain there for an extended period without being discovered while continuously gathering information and exploiting vulnerabilities.
The ESA does not know what data was stolen
ESA has reported that although they do not know exactly what data the hacker has stolen, the hacker has posted some of the data for sale on dark net markets. The posted data reportedly contains internal communications, technical specifications, and possibly usernames/passwords that could be used to steal additional information from other ESA systems.
Should the hacker post all of the stolen data, the stolen data could create a serious risk to ESA’s ability to complete current projects and collaborate with other countries.
A warning from cybersecurity professionals
Cybersecurity professionals are warning that such a breach can lead to a chain reaction of events, particularly when dealing with sensitive industries such as space exploration/satellite operations. For example, unauthorized access to a space mission plan or a technical specification of a space system could reveal potential vulnerabilities to an enemy and/or potentially cause a disruption to future launch schedules.
ESA stated they are currently collaborating with cybersecurity professionals/law enforcement agencies to mitigate the breach and limit the hacker’s ability to utilize the stolen data. Immediate steps taken to address the breach include disconnecting systems that may have been accessed by the hacker, changing user passwords, and implementing new tools to monitor for unusual/possible malicious activity.
Although ESA stated that the systems utilized to control the operation of spacecraft and satellites are safe and not at risk, the agency did acknowledge that the incident clearly illustrates the urgency for greater cybersecurity standards to be implemented across the entire space industry.
Space agencies and related organizations are becoming increasingly attractive targets
The breach clearly illustrates that space agencies and related organizations are becoming increasingly attractive targets for cyber criminals and foreign governments. As space research is extremely sensitive and strategically important, it is no surprise that these organizations are subject to both espionage and sabotage attempts by various groups.
Experts believe that the ESA breach will catalyze the global space community to review and possibly revise its current cybersecurity practices.
As ESA continues to investigate the breach
Many questions remain as to how the hacker was able to obtain access and if there are other vulnerabilities within the agency’s infrastructure that the hacker may have found and exploited.
Currently, ESA is advising its partners and contractors to exercise extreme caution and vigilance due to the breach. Additionally, ESA emphasizes the importance of maintaining strong cybersecurity practices throughout the space industry. The space industry, often viewed as a technological pioneer, must come to understand that its digital defense systems are equally as important as its physical missions.
