A hacker using the alias “888” has put up for sale an archive of roughly 200 gigabytes of data allegedly linked to projects associated with the European Space Agency, raising concerns about the exposure of sensitive technological and defence-related information. On 30 December 2025, reports emerged that the data was advertised on the BreachForums platform and claimed to originate from Bitbucket repositories connected to ESA, according to an investigation published by The Insider into the alleged sale of ESA-linked data on BreachForums.
The seller claims the archive contains proprietary technical documentation, project source code, elements of CI/CD infrastructure and sensitive service information such as passwords and API tokens. Analysts say the nature of the materials, if authentic, suggests access to internal development environments rather than a limited data scrape.
Defence-related projects among affected materials
Rocket launch analyst Georgy Trishkin said the leaked data appears to affect not only civilian research but also defence-oriented projects involving major European contractors, including Airbus Defense and Space. Based on screenshots shared by the hacker, Trishkin said there are indications that proprietary information linked to the JUICE scientific probe may be included, a project on which Airbus has worked.
He cautioned, however, that the full scope of the breach remains unclear. While industrial espionage in the aerospace sector is not uncommon, the public offer to sell such data significantly increases the risk profile, as it opens access to a broad and potentially hostile range of buyers beyond a narrow industrial or intelligence context.
ESA confirms breach and launches investigation
The European Space Agency has acknowledged the incident, confirming that it is aware of the alleged breach and has initiated an internal investigation. ESA has not publicly detailed which systems were affected or whether classified information was compromised, but the confirmation itself underscores the seriousness of the claims.
The incident follows a previous cyberattack disclosed in late 2024, when hackers compromised ESA’s official online store using malicious JavaScript code to harvest customers’ payment details. Together, the cases highlight persistent vulnerabilities in digital environments linked to high-profile European institutions.
Strategic risks for European security and industry
Security experts warn that the sale of such a large dataset poses risks well beyond reputational damage. If the data reaches state-backed actors or organised cybercriminal groups, it could be exploited for technical analysis of European space and defence capabilities, or used to facilitate further intrusions into related networks.
The case has renewed debate over the resilience of Europe’s cyber defences in strategic sectors. Despite substantial budgets and advanced technological capacity, cybersecurity across multinational projects often remains fragmented and heavily dependent on individual contractors’ practices. Analysts argue that without stricter access controls, unified security standards and regular independent audits, Europe’s investments in space and defence will remain vulnerable to comparatively low-cost but strategically significant cyberattacks.
