Airbus employees are being warned to take ‘all necessary precautions’ following a cyber-attack that saw personally identifiable information taken from its servers.
The company said it detected a "cyber-incident" on its ‘Commercial Aircraft business’ information systems resulting in unauthorised data access. It added that "there is no impact on Airbus’ commercial operations".
Airbus security experts are investigating the extent of the breach and its source, and the company has "taken immediate and appropriate actions to reinforce existing security measures".
So far it is known that the breach affected "professional contact and IT identification details of some Airbus employees in Europe", the company said in a statement.
Relevant regulatory authorities have been contacted in line with the General Data Protection Regulation.
In addition to building commercial and military aircraft and satellites, Airbus also has a cyber-security division providing cyber-security services to government agencies, military forces and critical national infrastructure predominantly in Europe.
In addition to providing remote and on-site SOC services, the company also has its own anti-malware solution called Orion which combines static analysis, sandboxing and machine learning to identify both known and zero-day threats.
Dan Turner, CEO at Deep Secure, said that this attack shows traditional cyber-security solutions are not enough to protect organisations’ data. "The Airbus breach is likely to become just another fleeting reference in the constant stream of data breaches we’ll witness this year. Incidents like this show that, no matter how robust the company’s security defences, traditional cyber-security solutions are unable to detect the growing number of zero-day and undetectable threats that cyber-criminals are creating.
"We must assume that hackers are better at attacking than we are at defending – and that’s why we must go beyond the ‘detect and protect’ approach to cyber-security and focus on preventing attacks. Only this way can we – the cyber-security industry – empower organisations to truly secure their data."
Irra Ariella Khi, CEO of VChain, said, "Personal data of employees, operatives, or passengers held by those operating in the aviation industry is highly sensitive. The industry is highly regulated for a reason: data security is vital for ensuring safety. Whatever the motivation of the attack is, we should not be making it so easy to access data."
She added: "The security breach against Airbus is another example that current processes for storing sensitive data are not fit for purpose. Holding data on centralised, vulnerabile systems is making it easy for hackers. We urgently need to move to systems built using privacy by design principles – where data security and obscurity are built into the system – and data is not in a box that is inevitably breached."
Max Vetter, chief cyber officer at Immersive Labs, said, "Companies like Airbus which contain highly specialised intellectual property are always going to be a target for threat actors. A huge amount of capital is poured into the R&D stage in such organisations, a cost which malicious actors can circumvent by trying to steal the resulting data. It is known that some nation states have been using this kind of espionage to speed up the production of technology for years. For this reason, it is crucial that technical countermeasures and cyber-skills are continually refined to keep pace with attackers."