Aerospace giant Boeing investigating a cyber attack following LockBit group's data theft claims

Aerospace giant Boeing has confirmed that it suffered a cyber security incident shortly after the LockBit group claimed that it infiltrated the company’s internal network and stole vast amounts of sensitive data from its servers.

On October 27, the LockBit ransomware group listed the global aerospace giant as a victim on its data leak site. The group claimed to be in possession of “tremendous amounts of sensitive data” allegedly stolen from the company and gave the company a deadline of five days to pay a ransom.

“A tremendous amount of sensitive data was exfiltrated and ready to be published if Boeing does not contact within the deadline,” the group said.

The ransomware group did not share any sample data to validate its claims apparently to “protect the company”, but promised that it will publish the same once the deadline expires.

Acknowledging the ransomware group’s claims, the aerospace giant said that it has launched an internal investigation to validate the claims of the threat actors and understand the nature and scope of the incident.

In a statement shared with the media, a Boeing spokesperson said, “We are assessing this claim.”

The aerospace giant recently released another statement in which it confirmed that it is investigating a cyber security incident that has affected its parts and distribution business.

“We are aware of a cyber incident impacting elements of our parts and distribution business. This issue does not affect flight safety. We are actively investigating the incident and coordinating with law enforcement and regulatory authorities. We are notifying our customers and suppliers,” a Boeing spokesperson said.

Commenting on the news, Erfan Shadabi, cybersecurity expert at comforte AG, said, “Boeing’s acknowledgement of the cyber incident and its cooperation with law enforcement are commendable steps in addressing the breach. The aerospace and defence sector, similar to various other industries, heavily depends on an extensive network of suppliers and partners.

It’s a common occurrence for threat actors to target vulnerabilities within these expansive ecosystems. One key takeaway from this incident is the importance of a proactive approach to cybersecurity that revolves around the safeguarding of data itself,” he added.

Recently, malware research firm vx-underground said that the Lockbit ransomware group removed Boeing from its list of victims after the aviation giant agreed to negotiate with the hackers.

“We keep getting pinged. Yes, Boeing has been removed from Lockbit ransomware groups website. Lockbit administrative staff informed us they removed Boeing because negotiations have begun. We don’t know anything else,” vx-underground said.