A dataset tied to NATO-linked defense giant Thales Group has surfaced on a cybercrime forum, raising fresh concerns that sensitive identity infrastructure used across European governments may be exposed. The company has confirmed the third-party data breach.
A dataset allegedly tied to Thales Group has surfaced on a cybercrime forum, raising fresh questions about whether Europe’s defense backbone has been breached.
French company Thales is a global leader in defense electronics and aerospace, and has expanded its digital security footprint following its acquisition of Imperva. The company boasts $25.8 billion (€22.1 billion) in revenue and has over 85,000 employees. It is a strategically critical company both for France and NATO.
The listing appeared on a known hacker forum and includes a small sample of two records. While limited in scope, the data's structure suggests links to LuxTrust, a Luxembourg-based digital identity provider that relies on Thales’ services.
Thales provides services to multiple clients, so it is likely that it handled LuxTrust data as well.
What data was allegedly exposed?
Cybernews researchers who reviewed the data samples say the format is more consistent with third-party or client-facing datasets than internal LuxTrust systems.
The sample includes:
- Full names
- Email addresses, including personal domains
- Account metadata
The data samples also include a “company” field, which indicates that it must originate from the provider's infrastructure.
“The inclusion of a company field suggests this is not raw internal LuxTrust data,” researchers noted.
“It looks more like data processed through an external service layer or partner platform.”
What are the risks?
Because LuxTrust operates at the intersection of government, finance, and enterprise authentication, even limited exposure of user identity data can carry disproportionate risk, particularly for phishing and social engineering campaigns.
“Even basic identity fields like names and email addresses can be used to build credible impersonation attempts,” Cybernews researchers said.
If confirmed, the incident would fit a broader industry trend in which attackers increasingly target identity ecosystems and partner platforms rather than hardened central systems.
Thales’ exposure risk is amplified by its role in defense and surveillance technologies. The company operates at the intersection of civilian and military systems, supplying radar, communication, and cybersecurity solutions to governments and critical industries.
Thales confirm data breach
Thales spokesperson confirmed to Cybernews that the company is aware of the claims on the hacker forum. The statement from the company highlights that the source of the data breach is "outsourced service."
"Based on the information currently available, this leak has no operational impact on the Group or its customers," the spokesperson said.
The company has informed CNIL, the French Personal Data Protection Authority, and started investigation.
Thales Group has been targeted before
Thales Group has been repeatedly referenced in cybercrime activity over the past several years. In 2022, the LockBit ransomware group claimed an intrusion involving Thales-related data.
The company later said its core systems were not breached and attributed the incident to a compromised partner account on a collaboration platform. LockBit subsequently released approximately 9.5GB of data.
In 2024, a threat actor known as “USDoD” also claimed access to Thales-related information, adding to a pattern of recurring allegations targeting the company’s extended digital ecosystem.
Updated on May 14th [16:10 p.m. GMT+2] with a statement from Thales.
Unlock exclusive Cybernews content on YouTube.
Your email address will not be published. Required fields are markedmarked