Europe’s defence giant Naval Group hit with major breach, hackers claim

Naval Group, France’s largest shipbuilder, has allegedly suffered a major hacker attack. Researchers believe that a data sample that attackers shared online contains real details. The company is heavily involved in the country’s defence sector.

A threat actor announced the supposed Naval Group data breach on a popular data leak forum. According to the attackers, they have accessed combat management systems (CMS) used by France’s submarines and frigates.

Interestingly, attackers don’t seem to be interested in selling the data, as data leak forum users often do. Instead, they’re looking to extort Naval Group by threatening to leak the data.

Naval Group is a major player in the European defence sector, employing over 15,000 people with a yearly revenue exceeding $5B (€4.3B). Its two main shareholders are the French state and Thales Group.

We’ve reached out to the company for comment and will update the article once we receive a reply.

What data does the Naval Group data breach involve?

According to the attackers’ data leak forum post, cybercrooks allegedly got their hands on:

• Source code used to power the CMS of military ships
• Network data
• Technical documents with varying restriction levels
• Access to developers’ virtual machines
• Confidential exchanges

If confirmed, the data breach would pose significant threats to the company as well as France’s national security. Access to the source code behind the CMS used in submarines and frigates would be of interest to any adversary the country has and would require investment to mitigate the problem.

The Cybernews research team investigated parts of the 13GB data sample that attackers attached to their post, concluding that the leaked details appear to be legitimate.

Attackers included various contracts, supposed information from the CMS itself, and multimedia that involves video from what looks like a submarine monitoring system. However, the latter is timestamped 2003.

However, financially motivated attackers often inflate the true impact of the data they obtain to pressure victims into meeting their extortion demands. As of now, it’s unclear what the true extent of the data breach is.

The Paris-headquartered Naval Group is a major player in naval defense design, development, and construction in France. The company's origins date back to the late 17th century, and it has been an integral part of the country's naval defense since.

For example, France’s only nuclear aircraft carrier, Charles de Gaulle, was built by the Naval Group, which at the time was known as DCN (Direction des Construction Navales).