ESA disclosed a data breach, hackers breached external servers

The European Space Agency (ESA) disclosed a data breach after a threat actor offered to sell data allegedly stolen from the organisation. A hacker using the moniker “888” announced the hack on BreachForums on 18 December, with SecurityWeek reporting that the actor offered to sell 200 GB of allegedly stolen data, including files from private Bitbucket repositories.

The claimed haul comprises source code, API and access tokens, configuration files, credentials, and confidential documents, with several screenshots published as proof of the breach. ESA said the incident affected a limited number of external servers outside its corporate network and that containment measures were applied while a forensic security analysis was initiated.

Initial findings indicated only a small set of external servers supporting unclassified scientific collaboration were impacted, and stakeholders have been notified as ESA plans to share updates. Our analysis so far, according to ESA’s statements on X, suggests that only a very small number of external servers may have been impacted.