Cyber-attack reported on European Space Agency servers

The European Space Agency has confirmed a cybersecurity incident affecting non-core servers used for collaborative engineering work, triggering a forensic investigation amid claims by hackers of large-scale data theft.

The European Space Agency (ESA) has acknowledged a recent cybersecurity breach involving a limited number of servers located outside its main corporate network. The affected systems, according to the agency, supported unclassified collaborative engineering activities and did not host sensitive or classified mission data.

In a statement issued on Tuesday, ESA said it had launched a forensic security investigation after learning of the incident and had taken steps to secure potentially impacted infrastructure. The confirmation followed claims made by a threat actor on an online hacking forum, who alleged unauthorised access to some of the agency’s internal development platforms for nearly a week.

Limited impact, investigation underway

ESA clarified that its preliminary assessment indicates the breach was confined to a small set of external servers and did not compromise its core operational network. “These systems are used to support scientific and engineering collaboration within the research community,” the agency said, adding that the analysis is ongoing.

The space agency has informed relevant stakeholders and said further details will be shared once the investigation progresses. ESA did not specify which platforms were accessed or the exact duration of the intrusion.

However, the hackers behind the claims have alleged that they extracted more than 200GB of data, including source code, configuration files, and development resources from private repositories. These claims have not been independently verified, and ESA has not confirmed the scale or nature of any data loss.

Not an isolated incident

The development highlights growing cybersecurity challenges faced by major scientific and government institutions worldwide. ESA, founded in 1975 and headquartered in Paris, coordinates space programmes across 23 member states and manages a multibillion-euro annual budget.

This is not the first cyber incident reported by the agency in recent years. In late 2024, ESA’s official online store was compromised, exposing customer and payment information through malicious code.

While ESA maintains that the current breach involves only unclassified systems, the incident underscores the increasing sophistication of cyber threats targeting research organisations and critical infrastructure.