Actor UNC6783 claims theft of 718K Safran customer records
A threat actor tracked as UNC6783 claims on a dark web forum to have stolen more than 718,000 customer and order records from Safran, the French aerospace and defense group, and shared a 1,000-record sample as proof. Safran has not commented and the claim remains unverified. If genuine, the case raises the risk of invoice fraud, BEC and targeted phishing against customers and partners, as the fields point to an ERP or supply-chain system.
What happened
An actor tracked as UNC6783 claims on a dark web forum to have stolen more than 718,000 customer and order records from Safran, the French aerospace and defense group. The claim includes names, emails, phone numbers and order and shipping data. Safran has not commented and the case remains unverified.
Why it matters
If genuine, the leak exposes Safran customers and partners to invoice fraud, BEC and targeted phishing, according to the source's analysis. The fields point to an ERP or supply-chain system as the origin. Companies that buy from Safran or supply to it face financial scams using real order data.
What to do
Alert procurement, finance and logistics teams about messages citing Safran order numbers, ERP references or shipping details as bait. Monitor for invoice fraud and BEC attempts. Wait for an official Safran statement before treating the case as confirmed.
For the technical team
- Affected
- Safran Base de dados de clientes e pedidos da Safran, grupo francês de aeroespacial e defesa; alegação do ator UNC6783 inclui n · Safran customer and order data, French aerospace and defense group. Alleged fields: order IDs, sales order numbers, ERP reference IDs, customer names, emails, phone numbers, part numbers, supplier codes and shipping details (AWB and bill of lading).
- Exploitation
- No exploitation reported. Claim by actor UNC6783 on a dark web forum, reported by DailyDarkWeb, with a 1,000-record sample shared as proof. No Safran confirmation and no independent verification.
- Fix
- Not applicable: breach allegation, with no vulnerability or fix cited in the sources.
- Vector
- Vector not described in the sources. Analyst note from the source: the data fields point to an ERP or supply-chain system.
- More details
- Analyst note from the source: unverified threat-actor claim, not confirmation of a breach. If genuine, Safran partners and customers face elevated risk of invoice fraud, BEC and targeted phishing. Safran has not commented.
Timeline
First public claim: actor UNC6783 announces theft of more than 718,000 Safran customer and order records, with a sample posted.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
