More Collins Aerospace Hacking Fallout

A Russian data extortion group threatened Sunday to release passenger data putatively stolen from the Dublin Airport days after its operator said it investigated a breach stemming from a September cybersecurity incident that affected airports across Europe.

See Also: The Rise of Agentic Commerce: Building Secure, Trusted Payments for the AI-Driven Economy

Russia-linked extortion group Everest Group said on its darkweb leak site that it has 1.5 million records, including passenger data, stolen from Dublin Airport. It started a countdown clock set to expire Saturday evening for the data’s publication unless it receives payment before then.

Everest claimed responsibility on Oct. 17 for hacking infrastructure underpinning software developed by U.S.-based Collins Aerospace that allows multiple airlines to share check-in desks and boarding gates.

A mid-September incident with the firm’s Muse software led to days of delays at several major European airports, including London Heathrow, Berlin Brandenburg and Brussels Airport. Dublin Airport was also affected (seer: Cyberattack Disrupts Services at Major European Airports).

A Dublin Airport Authority spokesperson on Friday told The RTE News the breach “is under active investigation, and we are working closely with our regulators and affected airline partners. At this time, there is no evidence of any direct impact on DAA systems,” a DAA spokesperson said.

The spokesperson said the data stored on the compromised network mainly was passenger boarding details for departure from Dublin Airport from Aug. 1 to Aug. 31.

The European Union’s Agency for Cybersecurity, known as ENISA, classified the Collins Aerospace hacking incident that led to delays as a ransomware attack.

Everest asserts on its darkweb site that it didn’t unleash crypto-locking malware. It said it found a Collins Aerospace’s FTP server ftp.arinc.com using “aiscustomer” and “muse-insecure” credentials to access data on Sept. 10 to Sept. 11. High volume downloading likely triggered a security alert, the group said, resulting in its access being cut off.

The outage of Muse check-in and boarding software, Everest asserted, occurred because Collins Aerospace itself shut down servers on Sept. 19.

Collins Aerospace told investors on Sept. 24 that it became aware on Sept. 19 of a “cybersecurity incident involving ransomware.” The company, a unit of publicly-traded RTX, did not return a request for comment.

It’s possible two separate cybercrime groups targeted Collins Aerospace nearly simultaneously without being aware of the other’s activity. Cyberthreat intel firm Hudson Rock wrote Thursday that it believes another ransomware group used credentials stolen in a 2022 infostealer infection to infect Muse servers with crypto-locking software on Sept. 19.

“In no way do we believe Collins Aerospace intentionally shut down their systems as the Everest group suggests,” Alon Gal, co-founder and CTO of Hudson Rock, told Information Security Media Group.

The U.K. National Crime Agency in September arrested a suspected Collins Aerospace hacker, later released on conditional bail (see: Suspected Collins Aerospace Hacker Arrested in UK).