Incident: Data Breach at MBDA Missile Systems Exposing Classified Military Documents

Published Date: 2022-08-25

Postmortem Analysis
Timeline 1. The software failure incident involving the data breach of classified military documents from MBDA Missile Systems happened around the end of 2020 [131291].
System 1. External hard drive used for data storage [131291] 2. Security measures protecting the data [131291]
Responsible Organization 1. Criminal hackers operating on Russian and English forums were responsible for causing the software failure incident by stealing data linked to a major European weapons maker, including MBDA Missile Systems [131291].
Impacted Organization 1. MBDA Missile Systems [131291]
Software Causes 1. The software cause of the failure incident was a data breach resulting from the hacking of MBDA Missile Systems' information from a compromised external hard drive [131291].
Non-software Causes 1. Compromised external hard drive: MBDA Missile Systems mentioned that their information was hacked from a compromised external hard drive, indicating a physical security breach [131291].
Impacts 1. Classified military documents, including blueprints of weapons used by Nato allies in the Ukraine war, were stolen and put up for sale by a hacker group, potentially compromising sensitive information [131291]. 2. Detailed drawings of MBDA equipment, marked as "proprietary information not to be disclosed or reproduced," were among the stolen data, raising concerns about intellectual property theft and unauthorized dissemination of sensitive information [131291]. 3. The breach led to the exposure of classified information such as "NATO CONFIDENTIAL," "NATO RESTRICTED," and "NATO SECRET" documents, potentially damaging Nato's interests and security [131291]. 4. The incident highlighted vulnerabilities in the supply chain, as the data breach was linked to one of MBDA's suppliers, emphasizing the importance of securing third-party relationships in the defense industry [131291].
Preventions 1. Implementing robust cybersecurity measures such as regular security audits, penetration testing, and network monitoring to detect and prevent unauthorized access to sensitive data [131291]. 2. Ensuring secure storage and encryption of sensitive information to protect against data breaches from compromised external hard drives or other storage devices [131291]. 3. Conducting thorough vetting and monitoring of third-party suppliers and partners to mitigate the risk of data breaches through the supply chain [131291]. 4. Enforcing strict access controls and user authentication mechanisms to limit access to classified and sensitive information only to authorized personnel [131291]. 5. Providing comprehensive cybersecurity training and awareness programs for employees to prevent social engineering attacks and enhance overall security posture [131291].
Fixes 1. Enhancing cybersecurity measures within MBDA Missile Systems to prevent future data breaches [131291]. 2. Conducting a thorough investigation to identify the vulnerabilities in the supplier network that led to the data breach [131291]. 3. Implementing stricter access controls and data protection protocols for sensitive information within the company and its suppliers [131291]. 4. Reviewing and potentially revising the classification and handling of sensitive information to prevent unauthorized disclosures [131291].
References 1. MBDA Missile Systems 2. Nato 3. Criminal hackers operating on Russian and English forums 4. Former Nato official

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown <Article 131291> does not provide information about a software failure incident happening again at either one_organization or multiple_organization. Therefore, the answer to this question is 'unknown'.
Phase (Design/Operation) design Unknown
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident in this case seems to be primarily within the system. The data breach and theft of classified military documents, including blueprints of weapons used by Nato allies, originated from within the system of MBDA Missile Systems. The breach involved hackers stealing data linked to the major European weapons maker, MBDA, from a compromised external hard drive. The stolen data included detailed drawings of MBDA equipment and classified information about employees and closed military projects [131291]. (b) outside_system: The incident also involved external factors contributing to the failure. Cyber criminals, operating on Russian and English forums, were selling the stolen data online for Bitcoins. The hackers claimed to have sold the data to at least one unknown buyer. Additionally, the breach took place in Italy, and investigations were centered around one of MBDA's suppliers, indicating external elements playing a role in the software failure incident [131291].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case appears to be primarily due to non-human actions, specifically a data breach carried out by criminal hackers who stole data linked to a major European weapons maker, MBDA Missile Systems. The hackers were able to access and steal classified military documents, including blueprints of weapons used by Nato allies in the Ukraine war, from a compromised external hard drive. This breach led to the exposure of sensitive information, such as detailed drawings of MBDA equipment and classified NATO documents, which were then put up for sale on online forums [131291]. (b) While the initial breach and exposure of data were non-human actions, there is also a human action component involved in this incident. The fact that the data breach occurred due to criminal hackers exploiting vulnerabilities in the system indicates that there may have been human errors or oversights in the cybersecurity measures implemented by MBDA Missile Systems or its suppliers. Additionally, the response to the breach, including investigations and cooperation with authorities, involves human actions taken by the company and relevant stakeholders to address the aftermath of the software failure incident [131291].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The data breach at MBDA Missile Systems was attributed to a compromised external hard drive, indicating a hardware-related vulnerability [131291]. (b) The software failure incident occurring due to software: - The data breach and theft of classified military documents were a result of criminal hackers exploiting software vulnerabilities to access and steal sensitive information from MBDA Missile Systems [131291].
Objective (Malicious/Non-malicious) malicious The software failure incident reported in the provided article [131291] is classified as a malicious failure. Criminal hackers were able to breach the data of MBDA Missile Systems, a major European weapons maker, and sell classified military documents online, including blueprints of weapons used by Nato allies in the Ukraine war. The hackers claimed to have "classified information about employees of companies that took part in the development of closed military projects" and provided documents labeled as "NATO CONFIDENTIAL", "NATO RESTRICTED", and "NATO SECRET" [131291]. This breach was a deliberate act by the hackers to steal sensitive information and sell it for financial gain, indicating a malicious intent to harm the system and compromise security.
Intent (Poor/Accidental Decisions) unknown Unknown
Capability (Incompetence/Accidental) unknown The articles do not provide information related to a software failure incident occurring due to development incompetence or accidentally.
Duration unknown The articles do not provide information about a software failure incident being either permanent or temporary.
Behaviour unknown (a) crash: The software failure incident in this case does not involve a crash where the system loses state and does not perform any of its intended functions. The incident is more focused on a data breach and theft of classified military documents rather than a system crash [131291]. (b) omission: The software failure incident does not involve the system omitting to perform its intended functions at an instance(s). The focus of the incident is on the theft and sale of classified data rather than the system failing to perform its functions [131291]. (c) timing: The software failure incident is not related to the system performing its intended functions correctly but too late or too early. The incident revolves around the data breach and theft of classified military documents rather than timing issues [131291]. (d) value: The software failure incident does not involve the system performing its intended functions incorrectly. The main issue in this incident is the theft and sale of classified military data rather than the system malfunctioning in its functions [131291]. (e) byzantine: The software failure incident does not exhibit the behavior of the system behaving erroneously with inconsistent responses and interactions. The incident primarily involves a data breach and theft of classified military documents rather than erratic system behavior [131291]. (f) other: The software failure incident in this case does not fall under the categories of crash, omission, timing, value, or byzantine behaviors. The primary issue is the unauthorized access, theft, and sale of classified military data rather than a specific software failure behavior [131291].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human (a) unknown (b) unknown (c) unknown (d) Property: The software failure incident led to the breach and theft of classified military documents and data from MBDA Missile Systems, a major European weapons maker. The stolen data included blueprints of weapons used by Nato allies in the Ukraine war, detailed drawings of MBDA equipment, and classified information about employees and military projects [131291].
Domain government The software failure incident reported in the news article [Article 131291] is related to the defense industry. The incident involved a data breach at MBDA Missile Systems, a major European weapons maker, where classified military documents, including blueprints of weapons used by Nato allies in the Ukraine war, were stolen by hackers. The stolen data contained detailed drawings of MBDA equipment and classified information about employees and military projects. The incident highlights the vulnerability of defense-related systems to cyber attacks and the potential risks associated with such breaches in the defense industry.

Sources

Back to List