Ukraine claims cyberattack on Russian aircraft manufacturer Tupolev, obtains 4.4GB of sensitive data

Ukraine’s military intelligence agency, the Main Intelligence Directorate (HUR), has reportedly executed a high-level cyberattack on Tupolev, a prominent Russian aerospace manufacturer of strategic bombers, gaining access to a significant trove of internal data. A source within the agency confirmed the breach to The Kyiv Independent on June 4.

The cyber operation targeted the Tupolev Design Bureau, a Soviet-era institution now fully integrated into Russia’s military-industrial complex and sanctioned internationally since 2022. Tupolev is known for producing the Tu-95 and Tu-160 bombers, aircraft central to Russia’s long-range missile capabilities and nuclear deterrence.

According to HUR, cyber operatives extracted more than 4.4 gigabytes of confidential material, including executive correspondence, employee personal data, home addresses, engineer resumes, procurement documentation, and minutes from closed meetings. Intelligence officers claim the breach has effectively stripped the company of operational secrecy.

The obtained data reportedly offers detailed insight into individuals responsible for the maintenance and operation of Russia’s strategic bomber fleet. The agency described the impact of the breach as likely to manifest “both on the ground and in the air.”

The hackers also defaced the Tupolev website, replacing its homepage with an image of an owl clutching a Russian aircraft — a visual symbol tied to Ukrainian military intelligence.

The breach follows a recent Ukrainian drone strike codenamed Operation Spiderweb, carried out by the Security Service of Ukraine (SBU), which reportedly damaged 41 aircraft across four Russian airbases. Though the scale of that attack has not been independently verified, it coincides with a coordinated strategy targeting the core of Russia’s aerial strike capacity.

Suspilne TV and other Ukrainian outlets reported that HUR had been covertly monitoring Tupolev’s internal communications prior to launching the full-scale cyber intrusion. Screenshots of internal documents and personnel files were provided to media outlets as evidence.