Airbus is preparing to migrate its most sensitive workloads to a European sovereign cloud, signaling a shift in how global corporations are approaching digital security and data sovereignty. The aerospace manufacturer intends to move key on-premises applications, including ERP systems, manufacturing execution systems, CRM platforms, and product lifecycle management tools, to a platform under European control.
“I need a sovereign cloud because part of the information is extremely sensitive from a national and European perspective,” said Catherine Jestin, Airbus executive vice president of digital. “We want to ensure this information remains under European control.”
The move is partly driven by software innovation. Vendors like SAP are now developing new features exclusively for cloud platforms, encouraging large organizations to migrate from legacy systems to modern cloud solutions. Airbus plans to launch a request for proposals in early January, with a decision expected before summer. The contract is expected to exceed €50 million and extend up to ten years, emphasizing long-term stability and price predictability.
Geopolitical pressures are a major factor. European companies are increasingly cautious about US cloud providers due to the CLOUD Act, which allows American authorities to access data stored abroad. Microsoft, AWS, and Google have developed solutions to address these concerns, but European organizations still fear potential exposure to extraterritorial regulations.
Jestin is waiting for clarification from European regulators on whether Airbus would truly be insulated from foreign laws and whether services could be interrupted in a crisis. Beyond US-related concerns, she also questions whether European cloud providers have sufficient scale to handle Airbus’s mission-critical workloads.
“This puts pressure on European providers to collaborate,” Jestin said. “Whether they can meet the requirements within our timeframe remains uncertain. Today, I would estimate an 80/20 chance of finding a solution.”
For everyday organizations, the Airbus case illustrates a larger trend: as digital operations become central to business strategy, sovereignty and security are increasingly critical. Companies must carefully evaluate where data is stored, how cloud providers operate, and what regulations apply, particularly when handling sensitive or mission-critical information.
For inquiries or story tips, email hello@laterstack.com.
Related Laterstack Cybersecurity Stories
Is Your Vibrator Spying on You? Understanding App-Connected Sex Toy Data
Apple and Google Roll Out Emergency Patches After Active Zero-Day Exploits
Credit Check Company 700Credit Exposes Personal Data of Over 5 Million Americans
Home Depot Exposed Internal Systems for a Year After Employee Leaked GitHub Token
A critical cybersecurity lapse at Home Depot allowed access to internal systems for roughly a year, after an employee mistakenly published a private GitHub access token online. Security researcher Ben Zimmermann discovered the exposure in early November 2025 and attempted to alert Home Depot privately, but the company initially did not respond.
The token, which had been exposed since early 2024, granted access to hundreds of private Home Depot repositories hosted on GitHub. According to Zimmermann, it provided full access to the company’s cloud infrastructure, including order fulfillment, inventory management, and code development pipelines.
Zimmermann noted that he reached out multiple times via email and even LinkedIn to Home Depot’s Chief Information Security Officer, Chris Lanzilotta, but received no response. The lack of a formal vulnerability disclosure or bug bounty program at Home Depot left the researcher with no official reporting channel. Ultimately, TechCrunch’s outreach prompted Home Depot to revoke the token and secure the exposed systems.
“Home Depot is the only company that ignored me,” Zimmermann told TechCrunch, contrasting the response from other firms who have thanked him for similar disclosures. The company has not commented on whether any unauthorized parties accessed internal systems during the exposure.
The incident highlights a growing issue in corporate cybersecurity: organizations increasingly rely on cloud-hosted development infrastructure, but many lack formal mechanisms to identify and remediate leaked credentials. Access tokens, if publicly available, can allow attackers to modify code, compromise operational systems, or disrupt critical workflows.
As companies continue to digitize operations and rely on GitHub and other developer platforms, establishing clear vulnerability reporting channels and proactive monitoring becomes essential. Home Depot’s delayed response underscores the risk when such protocols are absent.
Related Laterstack Cybersecurity Stories
For inquiries, tips, or submissions: hello@laterstack.com
Major Gainsight Supply Chain Breach Hits 200+ Companies
SAN FRANCISCO – Google has confirmed that hackers stole Salesforce-stored data from more than 200 companies in a large-scale supply chain hack via apps published by Gainsight, a customer support platform.
Austin Larsen, principal threat analyst at Google Threat Intelligence Group, stated that the company is “aware of more than 200 potentially affected Salesforce instances.”
The breach was claimed by the hacking collective Scattered Lapsus$ Hunters, which includes members of the ShinyHunters gang. The hackers stated they accessed data from major companies, including Atlassian, CrowdStrike, Docusign, F5, GitLab, LinkedIn, Malwarebytes, SonicWall, Thomson Reuters, and Verizon.
How the Hackers Gained Access
The hackers reportedly leveraged a prior campaign against Salesloft, which provides AI-driven marketing tools like Drift. They stole authentication tokens from Salesloft customers, allowing them to break into linked Salesforce instances through Gainsight.
“Gainsight was a customer of Salesloft Drift, they were affected and therefore compromised entirely by us,” said a spokesperson for ShinyHunters.
Salesforce confirmed the breach did not stem from vulnerabilities in its platform and has temporarily revoked active access tokens for Gainsight-connected apps as a precaution. Gainsight is collaborating with Google’s incident response unit, Mandiant, to investigate the incident.
Company Responses and Mitigation Efforts
Several affected companies provided statements on their current security posture:
CrowdStrike: Not affected; terminated a suspicious insider.
Docusign: No evidence of compromise; terminated Gainsight integrations and contained data flows.
Verizon & Thomson Reuters: Actively investigating.
Malwarebytes: Aware and investigating Gainsight/Salesforce issues.
Salesforce has stated it is following its policy of not commenting on specific customer cases.
Hacker Extortion Plans
The Scattered Lapsus$ Hunters collective has a history of data theft and extortion campaigns. Following the breach, they announced plans to launch a dedicated website to extort victims, mirroring tactics used in the October Salesloft incident. The group has previously targeted high-profile companies including MGM Resorts, Coinbase, and DoorDash.
These groups rely on social engineering and other techniques to compromise corporate systems, emphasizing the growing threat of sophisticated supply chain attacks in the cybersecurity landscape.
Looking Ahead
This incident highlights the risks of third-party software in enterprise environments, especially platforms connected to cloud services like Salesforce. Companies are advised to monitor unusual activity, enforce strict access controls, and coordinate with incident response teams to mitigate further exposure.
Related Laterstack Stories:
US Border Patrol Surveillance, Massive DDoS Attacks, and FBI Spying Make Headlines
Incognito Mode offers less privacy than most people think
WASHINGTON – The US Border Patrol is operating a predictive-intelligence program that tracks millions of American drivers far from the border, according to an Associated Press investigation. Covert license-plate readers hidden in traffic cones, barrels, and roadside equipment feed data into an algorithm that flags “suspicious” routes, quick turnarounds, and travel to and from border regions. Local police are then alerted, resulting in stops for minor infractions, such as window-tint violations or marginal speeding.
AP records show drivers have been questioned, searched, and sometimes arrested, even when no contraband was found. Internal group chats obtained through public-records requests revealed Border Patrol agents and Texas deputies sharing hotel records, rental car status, home addresses, and social media information in real time while coordinating “whisper stops” to obscure federal involvement. Plate-reader sites have been identified as far as 120 miles from the Mexican border in Phoenix, with additional locations near Detroit and Chicago.
Legal experts expressed concern over the program’s scale, warning it raises new Fourth Amendment issues. A UC Law San Francisco official described the system as a “dragnet” tracking Americans’ movements, associations, and routines.
Microsoft Thwarts Record-Breaking Cloud DDoS Attack
Tech giant Microsoft said it mitigated the largest distributed denial-of-service (DDoS) attack ever recorded in a cloud environment. The attack, launched on October 24 against a single Azure endpoint in Australia, reached 15.72 Tbps with 3.64 billion packets per second. Microsoft attributed the attack to the Aisuru botnet, a network of compromised consumer devices including home routers and cameras.
The Azure DDoS Protection network successfully absorbed the traffic with no disruption to service. Researchers have noted that Aisuru is increasingly using AI-driven attacks, credential stuffing, and HTTPS floods via residential proxies.
SEC Drops Remaining Claims Against SolarWinds
The U.S. Securities and Exchange Commission dismissed its remaining claims against SolarWinds and its CISO, Tim Brown, ending litigation tied to the 2020 supply-chain hack allegedly carried out by Russian SVR operatives. The lawsuit, filed in 2023, had largely been dismissed in 2024. SolarWinds hailed the dismissal as vindication and said it may ease concerns among CISOs regarding future regulatory scrutiny.
FBI Spied on Immigration Activist Signal Group
Law enforcement records revealed that the FBI accessed messages from a private Signal group used by New York immigration court-watch activists. A report dated August 28, 2025, labeled the nonviolent participants as “anarchist violent extremist actors” and circulated assessments nationwide.
The documents, obtained by the transparency group Property of the People, show that activists monitored public hearings and collected information on federal personnel. Civil liberties experts warned that the surveillance mirrors prior FBI campaigns targeting lawful dissent, potentially chilling protected political activity.
Other Notable Cybersecurity News
WhatsApp Exposure: Researchers at the University of Vienna demonstrated that phone numbers can still be extracted en masse via WhatsApp’s discovery feature, exposing billions of users.
Vape Detector Surveillance: U.S. high schools are using advanced vape detectors with microphones, raising privacy concerns among non-vaping students.
Cisco Security Warning: Cisco warned that outdated networking equipment is increasingly vulnerable as AI tools simplify exploitation of unpatched systems.
Anti-Virus Monitoring at Conferences: New Zealand’s Kawaiicon conference tracked CO2 levels to improve attendee safety, creating real-time air-quality monitoring systems.
Related stories on Laterstack:
Incognito Mode offers less privacy than most people think
12 Steps to Better Cybersecurity in 2025