European Space Agency confirms breach following leak of internal data

The European Space Agency (ESA) has confirmed a cybersecurity incident involving servers outside its corporate network, following claims by a threat actor who is offering 200 GB of allegedly stolen data for sale on a dark web forum.

ESA disclosed the breach publicly earlier today via a statement on its official X account. The agency reported that it had initiated a forensic investigation and implemented security measures to protect affected systems. According to ESA, the impacted infrastructure consists of a “very small number of external servers” used in unclassified, collaborative engineering projects. These servers are not connected to ESA’s internal corporate systems, and stakeholders have been notified of the situation.

On December 26, a notorious user on the hacking forum BreachForums operating under the alias “888” claimed responsibility for compromising ESA systems. The hacker stated that the intrusion began around December 18 and involved a week-long access to ESA’s infrastructure. The attacker alleges exfiltration of over 200 GB of data, including sensitive materials such as:

• Source code from private Bitbucket repositories
• CI/CD pipeline configurations
• API and access tokens
• Internal documentation
• SQL database files
• Terraform infrastructure code
• Hardcoded credentials and configuration files

The threat actor published several screenshots appearing to show directory structures, source code snippets, and internal configuration files, though their authenticity has not yet been independently verified. The data is being offered for a one-time sale, with payment requested in Monero (XMR), a cryptocurrency favored for its anonymity and low traceability.

The European Space Agency is a major intergovernmental organization composed of 23 member states, coordinating Europe’s space exploration, satellite programs, and scientific research. ESA operates a broad ecosystem of missions and partners, and while the agency has emphasized that the compromised systems support only unclassified research collaboration, the theft of internal development infrastructure could have downstream security implications, especially if secrets like tokens or credentials are reused in operational environments.

The forensic investigation by ESA is ongoing, and no details have been shared regarding the initial vector of compromise or whether the agency has validated the scope of the data breach as described by the attacker.