- Lockheed Martin’s data breach claim, hackers claimed they are selling the organization’s data, worth 375TB, for $598 million.
- The criminals increased their ransom demand from $400 million to $600 million. They threatened to sell the documents to US rival countries, such as China and Russia.
- A second group, Handala, has doxxed 28 senior engineers, publishing their addresses and threatening to turn their homes into missile targets.
The defense industry is facing a serious claim of a ransomware attack. The report noted a hacking group and its target to sell 375 terabytes of data it obtained from the largest defense contractor in the US, Lockheed Martin.
The hacking group, reportedly known as APT Iran, is allegedly offering the data for sale on a Russian-speaking darknet marketplace, “Threat Market,” for an astonishing price of $598 million.
The hackers stole sensitive data that is predominantly made up of highly classified documents, including technical blueprints for the F35 fighter jet, source codes, corporate emails, and employees’ personal information.
This incident would represent one of the largest breaches in US military history if these claims were substantiated; however, Lockheed Martin publicly stated there was no evidence of these claims.
The Price Keeps Going Up
The situation started in late March this year – the hackers launched a ransomware attack on Lockheed Martin and stole the company’s data. The criminals began with an initial demand of $400 million.
After the company failed to pay the ransom, the hackers increased the amount to $600 million. The criminals have now actually gone through a broker service – Threat Market – to sell the data they acquired from the breach.
The hackers claim they have already released some data for free to the IRGC – Iranian Revolutionary Guard Corps. Also, they warned that if Lockheed does not comply with their demands, they will sell the data to the highest bidder – potentially in China or Russia.
While Iran-linked groups focus on Lockheed Martin, pro-Russian hacktivists are simultaneously attacking Israeli banks, a reminder that multiple state-aligned cyber actors are currently engaged in coordinated campaigns against Western and Israeli targets, each pursuing their own geopolitical objectives.
Threats to Engineers and Families
This is not just about selling files. A second group, “Handala,” is part of the hack incident. They also have a link to Iran and are focusing on individual Lockheed Martin workers. Handala claims to have the personal details of 28 senior engineers working in Israel.
The group has published names, ID numbers, passport scans, and home addresses online. They claim they have contacted these engineers directly to prove they know where they live.
Handala gave these workers 48 hours to leave their jobs or face consequences, saying their homes could become “missile targets.” This has turned a data breach into a direct threat to human life.
Lockheed’s Response
The organization, Lockheed Martin, is fully aware of the claimed incident. In a recent press release, a representative of Lockheed Martin stated that they believe their company’s security systems are sound.
The representative added that the information lacked consistency with any evidence to ascertain that the reports are true. Further, Lockheed Martin stated that they will continue to actively monitor and secure their networks.
Despite Lockheed Martin’s confidence in its security systems, the market reacted negatively to this statement from the organization, Lockheed Martin’s share price dropped by $10 per share in stock market trading after the release of the news.
For now, security professionals are proceeding with caution with respect to these claims. Many high-profile breach claims have historically amounted to propaganda or fear tactics.
However, the involvement of known Iranian groups and the specific threats to employees mean authorities are taking this very seriously.
