_top_ — Onelogin Airbus

His daughter, Lena, was a cybersecurity analyst at a small Berlin firm. She answered on the second ring. “Dad? It’s seven a.m. Are you okay?”

Silence. Then, one by one, the overhead lights in the comms room flickered and stabilized. The plant was still powered, still alive—but it was an island. No internet. No cloud. No OneLogin.

“Pull the fiber. Not the power—the fiber. Cut the physical link between your plant and the internet. Everything else can wait.” onelogin airbus

The first sign came on a Tuesday. Klaus was reviewing fatigue-test data on a composite wing spar when his OneLogin portal refreshed unprompted. The dashboard flickered—just once—and then settled. But in that flicker, he saw something wrong. An extra application tile. A dark icon he didn’t recognize, labeled only with a string of alphanumerics: X7-99Q-LOGISTICS .

“The A350-1000ULR,” he whispered. “The ultra-long-range variant. The test flight scheduled for Monday. If someone had access to the flight control tuning parameters—” His daughter, Lena, was a cybersecurity analyst at

“They could push a bad update,” Lena finished. “Or lock the pilots out mid-flight. Or just make the plane think it was somewhere it wasn’t. Dad, you need to get to the physical backup of the identity directory. The one that’s air-gapped. Does Airbus still do tape backups?”

“It’s Friday. The last clean backup was six days ago. That’s six days of changes, but it’s better than nothing. You need to restore that backup onto a completely isolated environment, change every single shared secret, and rebuild OneLogin from scratch. But you can’t do that alone. You need the other plants to cut their links too.” It’s seven a

“Good. Now listen. I’ve been watching some traffic patterns since you called. Dad, this isn’t random. This isn’t ransomware. Whoever did this, they didn’t want money. They wanted everything . The identity provider wasn’t just breached—it was forked . They cloned the entire Airbus directory, all 73,000 identities, and inserted their own super-admin accounts with the same biometric hashes, the same MFA seeds. Then they used OneLogin’s own provisioning engine to push those accounts to every connected application. They didn’t break in. They walked in, using keys that Airbus itself made for them.”