5165

On 18 December 2025 an actor calling themself "888" claimed to have breached the European Space Agency and exfiltrated over 200 GB of internal data—including private Bitbucket repositories, internal documentation, infrastructure definitions, and sensitive credentials—and advertised the files for sale on DarkForums for Monero. The ESA acknowledged a cybersecurity incident affecting a small number of external, unclassified servers used for collaborative scientific engineering, and launched a forensic investigation and containment effort; preliminary findings indicate the impact was confined to those limited servers.