Phishing Attack Targets Defense Giant ‘General Dynamics’, Employees Data Breached

• Aerospace and defense contractor General Dynamics acknowledged a complex phishing attack that targeted the company’s third-party benefits accounts.
• Dozens of employee benefit accounts were compromised as a result, exposing personal and financial data.
• The attackers altered bank account information in employee benefits accounts in some cases.

General Dynamics, a leading aerospace and defense contractor, has reported a successful phishing attack targeting its employees. The breach resulted in the compromise of dozens of employee benefits accounts, exposing sensitive personal and financial information.  

The compromised accounts allowed attackers to access a wide range of personal information, including names, dates of birth, government-issued identification numbers, Social Security numbers, bank account details, and disability status. 

For some victims, bank account information was altered within the compromised benefits accounts.  

The unauthorized activity was first identified on October 10, when the company detected unauthorized changes to employee benefits accounts accessible via a third-party login portal. Unauthorized access was first recorded on October 1. 

Threat actors executed the attack by deceiving employees into providing their login credentials on a phishing website designed to mimic legitimate access points.  

The attackers reportedly launched a fraudulent advertising campaign to lure General Dynamics employees to the phishing website. By imitating the Employee Self Service portal, the threat actors successfully harvested login credentials, which they then used to access the victims' Fidelity NetBenefits accounts. 

“The malicious actor was then able to access the accounts of the employees who provided this information to the false third-party login site,” the company explained in a statement to the Maine Attorney General’s Office. General Dynamics confirmed that 37 employees were affected by the breach.  

General Dynamics stated that the attack exploited third-party authentication rather than compromising its internal business units. 

General Dynamics immediately suspended access to the affected Employee Self Service portal. Notification letters to impacted individuals began that same day, with additional notifications mailed this week.  

To mitigate the fallout, the company offers the affected individuals two years of complimentary credit monitoring. Impacted employees were also advised to reset their Fidelity account credentials and ensure those credentials are not reused across other platforms or services.  

In its communication with affected parties, General Dynamics reiterated the importance of securing Fidelity accounts and discontinuing the use of previously compromised credentials. The company emphasized that it is unaware of the ill use of exposed data.

Aerospace sectors worldwide were also targeted by Lazarus Group recently, as the threat actor deployed backdoors that target professionals.