Table of contents
- A cyberattack shakes the Italian aerospace sector
- What we know so far
- Who are the 3AM hackers?
- Leonardo and cyber security authorities respond
- A supply chain attack?
- What happens next?
A cyberattack shakes the Italian aerospace sector
A ransomware attack has hit Rotorsim, a joint venture between Italian giant Leonardo and Canadian firm CAE, specializing in helicopter pilot training via advanced simulators. The pro-Russian hacker group 3AM has claimed responsibility, alleging they breached Leonardo’s systems, a claim the company has firmly denied.
According to initial investigations, the attack was confined to Rotorsim’s network, with Leonardo’s infrastructure remaining untouched.
However, on the cyber gang’s dark web page, a detailed filetree of stolen data—totaling 4,335 PDF pages—has already been published, hinting at a massive data breach.
What we know so far
The cyberattack was discovered on February 13, 2025, by RedACT, an Italian cyber security research group. The hackers initially released only 1% of the stolen data, including documents related to AW169 and AW139 helicopters, both used in civil and military applications.
While the exact content of the stolen files remains unknown, the mere publication of their names is a serious security concern.
Who are the 3AM hackers?
3AM is a relatively new cybercriminal group, but in the past three years, they have carried out 56 attacks, targeting major corporations for large ransom payments. Unlike other ransomware gangs, they focus on high-value, targeted attacks rather than mass operations.
Initial reports suggest that the stolen data includes technical manuals, installation guides, and flight simulator documentation, along with internal corporate files. However, it remains unclear whether these documents contain sensitive information.
Leonardo and cyber security authorities respond
After 3AM’s public claim, Leonardo denied any breach of its IT systems, clarifying that Rotorsim operates on an independent network managed by CAE, separate from Leonardo’s infrastructure.
Meanwhile, the National Cybe Security Agency (ACN) has launched an investigation to assess the scope of the attack and its potential implications.
A supply chain attack?
Experts speculate that this could be a supply chain attack, where hackers infiltrated a third-party supplier rather than Leonardo’s main infrastructure.
This theory is supported by the presence of a file referencing a subcontractor providing training and operational support solutions.
Currently, 160,301 files totaling 239GB have been reported as stolen, including training courses, manuals, and simulator data. The actual sensitivity of these documents remains uncertain.
What happens next?
If 3AM does not receive a ransom, they may decide to release all stolen data, potentially jeopardizing Rotorsim’s operations. However, without confirmation on the critical nature of the leaked information, the full impact remains unclear.
Leonardo has reassured stakeholders via an official X (formerly Twitter) post, stating that reports of a direct breach are unfounded.
