Bombardier Statement on Cybersecurity Breach

Rhea-AI Summary

Bombardier reported a limited cybersecurity breach on February 23, 2021, due to a vulnerability in a third-party file-transfer application. An unauthorized party accessed sensitive data affecting approximately 130 employees in Costa Rica.

Bombardier's security measures helped contain the incident, and they are collaborating with cybersecurity experts and authorities to investigate further. The breach was not targeted specifically at Bombardier, and key operations remain unaffected. The company is actively notifying impacted stakeholders and remains committed to securing its IT infrastructure.

Positive

• Effective security controls limited the scope of the breach.
• Prompt response and investigation with external cybersecurity professionals.
• No impact on manufacturing and customer support operations.

Negative

• Approximately 130 employees had their personal data compromised.
• Sensitive data relating to customers and suppliers was also exposed.

MONTREAL, Feb. 23, 2021 (GLOBE NEWSWIRE) -- Bombardier (TSX: BBD.B) announced today that it recently suffered a limited cybersecurity breach. An initial investigation revealed that an unauthorized party accessed and extracted data by exploiting a vulnerability affecting a third-party file-transfer application, which was running on purpose-built servers isolated from the main Bombardier IT network.

In accordance with established cybersecurity procedures and policies, Bombardier promptly initiated its response protocol upon detection of the data security incident. As part of its investigation, Bombardier sought the services of cybersecurity and forensic professionals who provided external confirmation that the company’s security controls were effective in limiting the scope and extent of the incident. Bombardier also notified appropriate authorities, including law enforcement, where required and will continue to work with the authorities as the investigation continues.

Forensic analysis revealed that personal and other confidential information relating to employees, customers and suppliers was compromised. Approximately 130 employees located in Costa Rica were impacted. Bombardier has been proactively contacting customers and other external stakeholders whose data was potentially compromised. The ongoing investigation indicates that the unauthorized access was limited solely to data stored on the specific servers. Manufacturing and customer support operations have not been impacted or interrupted. Bombardier can also confirm the company was not specifically targeted—the vulnerability impacted multiple organizations using the application. Bombardier will continue to assess the situation and stay in close contact with its clients, suppliers and employees, as well as other stakeholders.

With the ever-increasing number and sophistication of cybersecurity attacks on corporate groups, Bombardier remains committed to maintaining the integrity of its IT infrastructure and safeguarding employee, client and supplier information.

About Bombardier
Bombardier is a global leader in aviation, creating innovative and game-changing planes. Our products and services provide world-class experiences that set new standards in passenger comfort, energy efficiency, reliability and safety.

Headquartered in Montréal, Canada, Bombardier is present in more than 12 countries including its production/engineering sites and its customer support network. The Corporation supports a worldwide fleet of approximately 4,900 aircraft in service with a wide variety of multinational corporations, charter and fractional ownership providers, governments and private individuals.

News and information is available at bombardier.com or follow us on Twitter @Bombardier.

Notes to Editors
To receive our press releases, please visit the RSS Feed section.

Bombardier is a registered trademark of Bombardier Inc. or its subsidiaries.

For Information
Mark Masluch
Bombardier
+ 1 514-855-7167
mark.masluch@aero.bombardier.com

FAQ

What happened in the Bombardier cybersecurity breach?

Bombardier experienced a limited cybersecurity breach due to a vulnerability in a third-party file-transfer application, allowing unauthorized access to sensitive data.

How many employees were affected by the Bombardier breach?

Approximately 130 employees in Costa Rica were impacted by the data breach.

Was Bombardier specifically targeted in the recent cyber incident?

No, Bombardier was not specifically targeted; the vulnerability affected multiple organizations using the same application.

What measures is Bombardier taking after the data breach?

Bombardier has initiated a response protocol, engaged cybersecurity experts for investigation, and is notifying impacted stakeholders.

Did the cybersecurity breach affect Bombardier's operations?

No, Bombardier confirmed that their manufacturing and customer support operations were not impacted by the breach.