OwlyScan research 11 min read

Fewer Named in more publications → More certification passages → none Supplier: equipment, France. Publications that name it: high. Certification passages: high. Named most often with Safran.Supplier: equipment, UK. Publications that name it: high. Certification passages: high. Named most often with Safran.Supplier: aerostructures, other Europe. Publications that name it: low. Certification passages: high. Named most often with Safran.Supplier: equipment, North America. Publications that name it: high. Certification passages: high. Named most often with Safran.Supplier: equipment, other Europe. Publications that name it: high. Certification passages: high. Named most often with Airbus.Supplier: materials, North America. Publications that name it: high. Certification passages: high. Named most often with Safran.Supplier: materials, North America. Publications that name it: high. Certification passages: high. Named most often with Safran.Supplier: aerostructures, other Europe. Publications that name it: high. Certification passages: high. Named most often with Airbus.Supplier: equipment, other Europe. Publications that name it: high. Certification passages: high. Named most often with Thales.Supplier: aerostructures, UK. Publications that name it: high. Certification passages: high. Named most often with Airbus.Supplier: materials, France. Publications that name it: high. Certification passages: high. Named most often with Airbus.Supplier: materials, UK. Publications that name it: high. Certification passages: high. Named most often with Safran.Supplier: engineering, France. Publications that name it: middle. Certification passages: high. Named most often with Airbus.Supplier: materials, North America. Publications that name it: high. Certification passages: high. Named most often with Thales.Supplier: aerostructures, other Europe. Publications that name it: middle. Certification passages: middle. Named most often with Airbus.Supplier: materials, Germany. Publications that name it: middle. Certification passages: middle. Named most often with Airbus.Supplier: equipment, UK. Publications that name it: middle. Certification passages: middle. Named most often with Safran.Supplier: materials, France. Publications that name it: middle. Certification passages: middle. Named most often with Airbus.Supplier: equipment, France. Publications that name it: high. Certification passages: middle. Named most often with Thales.Supplier: aerostructures, France. Publications that name it: middle. Certification passages: middle. Named most often with Safran.Supplier: aerostructures, France. Publications that name it: high. Certification passages: middle. Named most often with Thales.Supplier: equipment, Germany. Publications that name it: middle. Certification passages: middle. Named most often with Safran.Supplier: aerostructures, Spain. Publications that name it: low. Certification passages: middle. Named most often with Airbus.Supplier: engineering, France. Publications that name it: low. Certification passages: middle. Named most often with Airbus.Supplier: aerostructures, North America. Publications that name it: middle. Certification passages: middle. Named most often with Thales.Supplier: engineering, France. Publications that name it: high. Certification passages: middle. Named most often with Airbus.Supplier: aerostructures, France. Publications that name it: middle. Certification passages: middle. Named most often with Safran.Supplier: materials, France. Publications that name it: low. Certification passages: middle. Named most often with Airbus.Supplier: equipment, France. Publications that name it: middle. Certification passages: low. Named most often with Safran.Supplier: equipment, France. Publications that name it: low. Certification passages: low. Named most often with Airbus.Supplier: equipment, Germany. Publications that name it: middle. Certification passages: low. Named most often with Airbus.Supplier: equipment, Germany. Publications that name it: middle. Certification passages: low. Named most often with Airbus.Supplier: aerostructures, France. Publications that name it: middle. Certification passages: low. Named most often with Safran.Supplier: materials, France. Publications that name it: low. Certification passages: low. Named most often with Airbus.Supplier: engineering, France. Publications that name it: middle. Certification passages: low. Named most often with Safran.Supplier: engineering, France. Publications that name it: low. Certification passages: low. Named most often with Airbus.Supplier: aerostructures, other Europe. Publications that name it: middle. Certification passages: low. Named most often with Airbus.Supplier: aerostructures, France. Publications that name it: low. Certification passages: low. Named most often with Airbus.Supplier: engineering, France. Publications that name it: low. Certification passages: low. Named most often with Airbus.Supplier: equipment, France. Publications that name it: middle. Certification passages: low. Named most often with Airbus.Supplier: engineering, France. Publications that name it: low. Certification passages: low. Named most often with Safran.Supplier: engineering, France. Publications that name it: high. Certification passages: none. Named most often with Airbus.Supplier: equipment, Germany. Publications that name it: low. Certification passages: none. Named most often with Airbus.Supplier: aerostructures, France. Publications that name it: low. Certification passages: none. Named most often with Safran.Supplier: aerostructures, France. Publications that name it: low. Certification passages: none. Named most often with Airbus.Supplier: aerostructures, France. Publications that name it: low. Certification passages: none. Named most often with Thales.Supplier: aerostructures, Spain. Publications that name it: low. Certification passages: none. Named most often with Airbus.Supplier: aerostructures, France. Publications that name it: low. Certification passages: none. Named most often with Safran. 25 of the suppliers shown are named most often with Airbus. 6 of the suppliers shown are named most often with Thales. 17 of the suppliers shown are named most often with Safran. None of the suppliers shown is named most often with Dassault Aviation. Airbus and its suppliers Thales and its suppliers Safran and its suppliers Dassault Aviation and its suppliers Equipment, FranceEquipment, UKAerostructures, other EuropeEquipment, North America
Fewer Named in more publications → More certification passages → none Supplier: equipment, France. Publications that name it: high. Certification passages: high. Named most often with Safran.Supplier: equipment, UK. Publications that name it: high. Certification passages: high. Named most often with Safran.Supplier: aerostructures, other Europe. Publications that name it: low. Certification passages: high. Named most often with Safran.Supplier: equipment, North America. Publications that name it: high. Certification passages: high. Named most often with Safran.Supplier: equipment, other Europe. Publications that name it: high. Certification passages: high. Named most often with Airbus.Supplier: materials, North America. Publications that name it: high. Certification passages: high. Named most often with Safran.Supplier: materials, North America. Publications that name it: high. Certification passages: high. Named most often with Safran.Supplier: aerostructures, other Europe. Publications that name it: high. Certification passages: high. Named most often with Airbus.Supplier: equipment, other Europe. Publications that name it: high. Certification passages: high. Named most often with Thales.Supplier: aerostructures, UK. Publications that name it: high. Certification passages: high. Named most often with Airbus.Supplier: materials, France. Publications that name it: high. Certification passages: high. Named most often with Airbus.Supplier: materials, UK. Publications that name it: high. Certification passages: high. Named most often with Safran.Supplier: engineering, France. Publications that name it: middle. Certification passages: high. Named most often with Airbus.Supplier: materials, North America. Publications that name it: high. Certification passages: high. Named most often with Thales.Supplier: aerostructures, other Europe. Publications that name it: middle. Certification passages: middle. Named most often with Airbus.Supplier: materials, Germany. Publications that name it: middle. Certification passages: middle. Named most often with Airbus.Supplier: equipment, UK. Publications that name it: middle. Certification passages: middle. Named most often with Safran.Supplier: materials, France. Publications that name it: middle. Certification passages: middle. Named most often with Airbus.Supplier: equipment, France. Publications that name it: high. Certification passages: middle. Named most often with Thales.Supplier: aerostructures, France. Publications that name it: middle. Certification passages: middle. Named most often with Safran.Supplier: aerostructures, France. Publications that name it: high. Certification passages: middle. Named most often with Thales.Supplier: equipment, Germany. Publications that name it: middle. Certification passages: middle. Named most often with Safran.Supplier: aerostructures, Spain. Publications that name it: low. Certification passages: middle. Named most often with Airbus.Supplier: engineering, France. Publications that name it: low. Certification passages: middle. Named most often with Airbus.Supplier: aerostructures, North America. Publications that name it: middle. Certification passages: middle. Named most often with Thales.Supplier: engineering, France. Publications that name it: high. Certification passages: middle. Named most often with Airbus.Supplier: aerostructures, France. Publications that name it: middle. Certification passages: middle. Named most often with Safran.Supplier: materials, France. Publications that name it: low. Certification passages: middle. Named most often with Airbus.Supplier: equipment, France. Publications that name it: middle. Certification passages: low. Named most often with Safran.Supplier: equipment, France. Publications that name it: low. Certification passages: low. Named most often with Airbus.Supplier: equipment, Germany. Publications that name it: middle. Certification passages: low. Named most often with Airbus.Supplier: equipment, Germany. Publications that name it: middle. Certification passages: low. Named most often with Airbus.Supplier: aerostructures, France. Publications that name it: middle. Certification passages: low. Named most often with Safran.Supplier: materials, France. Publications that name it: low. Certification passages: low. Named most often with Airbus.Supplier: engineering, France. Publications that name it: middle. Certification passages: low. Named most often with Safran.Supplier: engineering, France. Publications that name it: low. Certification passages: low. Named most often with Airbus.Supplier: aerostructures, other Europe. Publications that name it: middle. Certification passages: low. Named most often with Airbus.Supplier: aerostructures, France. Publications that name it: low. Certification passages: low. Named most often with Airbus.Supplier: engineering, France. Publications that name it: low. Certification passages: low. Named most often with Airbus.Supplier: equipment, France. Publications that name it: middle. Certification passages: low. Named most often with Airbus.Supplier: engineering, France. Publications that name it: low. Certification passages: low. Named most often with Safran.Supplier: engineering, France. Publications that name it: high. Certification passages: none. Named most often with Airbus.Supplier: equipment, Germany. Publications that name it: low. Certification passages: none. Named most often with Airbus.Supplier: aerostructures, France. Publications that name it: low. Certification passages: none. Named most often with Safran.Supplier: aerostructures, France. Publications that name it: low. Certification passages: none. Named most often with Airbus.Supplier: aerostructures, France. Publications that name it: low. Certification passages: none. Named most often with Thales.Supplier: aerostructures, Spain. Publications that name it: low. Certification passages: none. Named most often with Airbus.Supplier: aerostructures, France. Publications that name it: low. Certification passages: none. Named most often with Safran. 25 of the suppliers shown are named most often with Airbus. 6 of the suppliers shown are named most often with Thales. 17 of the suppliers shown are named most often with Safran. None of the suppliers shown is named most often with Dassault Aviation. Airbus Thales Safran Dassault Aviation

Map of 52 companies. Further right, more publications name the company. Higher, more passages name it with a certification term. Airbus, Thales and Safran sit at the top right. Dassault Aviation sits in the middle. Each of the 48 suppliers is linked by a line to the big company it is most often named with: 25 to Airbus, 17 to Safran, 6 to Thales, none to Dassault Aviation.

Four big companies and 48 of their suppliers in the files that ransomware groups have published. Each supplier is linked to the big company it is most often named with. Suppliers are not named.

Airbus, Safran and Thales suppliers: the certification files a foreign aircraft maker could look for

A foreign aircraft maker wants to sell its airliner in Europe. For the Chinese C919, EASA’s director says certification may take three to six years.

Our hypothesis: a competitor’s certification evidence would be a head start. It sits with European makers and their suppliers, and ransomware groups now publish suppliers’ files. We searched what is out.

A plane that cannot be sold yet

COMAC, the Chinese aircraft maker, builds the C919. It is a narrow-body jet that aims to rival the bestselling single-aisle aircraft of Airbus and Boeing.[1]

The C919 began commercial service in China in 2023.[1] It cannot be sold to a European airline until EASA, the European aviation safety agency, certifies it.

The European Union and China have had a bilateral aviation safety agreement since September 2020. Its procedures set how each authority validates the other’s approvals.[2] They do not remove the work.

COMAC had hoped for European approval in 2025. In April 2025, EASA’s executive director, Florian Guillermet, said that was not possible. He said it may take between three and six years.[1]

In July 2026, Air Journal reported new progress, citing the South China Morning Post. EASA test pilots had flown the aircraft in China for months.

Nearly all test flights were said to be complete. Air Journal carried the April 2025 estimate forward: a European approval between 2028 and 2031.[3]

The C919's road to a European certificate
  1. 2020: EU-China safety agreement in force
  2. 2023: in service in China
  3. April 2025: EASA says three to six years
  4. Today
  5. 2028 to 2031: likely approval window, by that estimate

Dates from EASA and press reports.[1][2][3]

So time is the cost. Every year without the certificate is a year without European sales.

This is a hypothesis about motive. Nothing here says that COMAC, or any aircraft maker, bought or used published files.

What certification leaves behind

EASA describes type certification in four steps.[4]

The four steps of an EASA type certificate
  1. 1
  2. 2
  3. 3 the longest phase
  4. 4

Widths are illustrative. EASA gives no duration per step. It says only that the third is the longest.[4]

  1. Technical familiarisation and certification basis. The design organisation presents the project to EASA.
  2. Establishment of the certification programme. The applicant proposes how it will show compliance.
  3. Compliance demonstration. It is done by analysis, simulations, flight tests and ground tests.
  4. Technical closure and issue of approval.

EASA calls the third step the longest phase of the process. For large aircraft, the period to complete a certification project is set at five years, and can be extended.[4]

That third step leaves paper behind: the reports of all those analyses and tests. They show what the authority asked and what it accepted.

The aircraft maker does not hold all of it. An equipment maker keeps the test reports of its own part. An engineering contractor keeps drafts of the documents it writes for its client.

One certification file, several holders

One certification file

  • The aircraft maker what it shows the authority
  • An equipment maker the test reports of its own part
  • An engineering contractor drafts of the documents it writes for its client

Each holder protects its copy in its own way.

So one certification file is spread over many companies. They do not all protect it the same way.

For a newcomer, a competitor’s evidence would be a shortcut. That is the hypothesis of this study, not a finding.

It has been tried before

That aerospace companies’ files are a target is on the public record. Five dated events show it. Two of them name the same Chinese intelligence bureau.

October 2018

The United States indicted ten Chinese nationals, two of them intelligence officers of the Jiangsu security bureau.[5] The target was the technology behind a turbofan engine used in commercial airliners.

The engine was developed by a French aerospace manufacturer with an office in Suzhou and a US firm. The indictment did not name them.

Two of the ten worked for the French company.

September 2019

AFP reported four major cyberattacks in twelve months against Airbus suppliers.[6] The attackers took over the access that linked a supplier to Airbus.

According to CERT-EU’s summary, they were especially interested in certification documents. AFP’s sources suspected groups linked to China. No formal attribution was made.

October 2019

The security firm CrowdStrike described a group it calls Turbine Panda.[7] Between 2010 and 2015, it ran cyberespionage attacks against several of the companies that supply C919 components.

CrowdStrike linked the group to the Jiangsu bureau of China’s Ministry of State Security.

November 2022

A US federal court sentenced Yanjun Xu to 20 years in prison.[8] He was a former officer of China’s Ministry of State Security.

He had been convicted of conspiring and attempting to commit economic espionage. The target was GE Aviation’s composite engine fan module.

September 2023

A hacker claimed to have breached Airbus and published some of its business documents.[9] He had apparently also obtained the details of 3,200 people at Airbus vendors.

Airbus said an account of one of its customers had been used on one of its portals.

These are espionage and intrusion cases. None of them is a court finding against COMAC.

They show two things. Aerospace engineering files were a target, and in 2019 certification documents by name. And the way in was often someone else: a supplier’s access, a customer’s account, a company’s own employees.

What changed: nobody has to break in

In each of those cases, someone had to get in. That took skill, time and risk.

Ransomware changed the cost. Groups publish the files of companies that do not pay, and anyone can download them.

Two ways a supplier’s file reaches a third party

Before

  1. An attacker targets a supplier
  2. It breaks in and stays hidden
  3. It takes the files it wants

Skill, time and risk

Now

  1. A ransomware group hits a supplier
  2. The supplier does not pay
  3. The files are published
  4. Anyone can download them

Nothing left to break into

November 2022 shows it. A ransomware group published an archive of Thales data.[10] Thales said it had found no intrusion in its own systems.

It named two likely sources. One was a partner’s account on a collaboration portal, which exposed a limited amount of information.

By that account, a company’s files can become public without its own systems being touched. A document that once took an intrusion can sit in a public archive, mixed with payroll files and invoices.

The industry knows it. In July 2026, GIFAS announced a programme that targets up to 200 SMEs and mid-sized firms by the end of 2027.[11] It aims to raise their cyber maturity with AirCyber, the sector’s cybersecurity standard.

What is already published

OwlyScan is a search engine over the files these groups put online. We searched it for European aerospace.

We took ten names: four big companies and six of their suppliers. We looked for passages that hold a name and one of six certification terms, such as EASA, type certificate or test report. A passage is a piece of a document.

  • 8× more certification terms around aerospace names than outside aerospace
  • 4 in 5 or more of the suppliers on the map have a certification passage
  • 2× the supplier matches once workshop words are added

Certification terms are 8 times more frequent around aerospace names

Thousands of passages match. That says little by itself: a company named everywhere is named near every word.

So we ran the same search on ten large companies outside aerospace. Allowing for size, certification terms are about 8 times more frequent around the aerospace names.

One caution. The comparison companies work in food, retail and pharmaceuticals, so part of this gap is plain vocabulary.

A comparison with other certified industries, such as rail or medical devices, is still to be done.

How often a certification term stands next to a company name
  • Ten aerospace names 8 times
  • Ten large companies outside aerospace 1

Six terms: EASA, type certificate, Part 21 and test report, and the French forms of type certificate and test report.

Half of it rests on one generic term

Two terms carry most of the matches: "test report" and EASA. "Test report" alone accounts for about half.

Every industry writes test reports. EASA is different: it is the regulator’s name, and only aviation uses it.

On the term EASA alone, one of the four big companies, with its suppliers, holds more than four fifths of the matches.

What the matches rest on
  • Matches that rest on the term “test report” about half
  • EASA matches held by one big company and its suppliers more than four fifths

Almost half comes from one batch

The matches are not spread evenly. One collection batch, roughly one publication, holds almost half of them. Ten batches hold more than four fifths.

So what is in circulation comes from a few events. Without the largest batch, the rate is still more than 4 times higher than outside aerospace.

And the index keeps growing. Four in ten of these passages entered it in 2026. That dates our collection, not the publication.

A few publications carry most of it
  • The largest batch almost half
  • The ten largest batches more than four fifths
  • Passages that reached us in 2026 four in ten

Suppliers are on the map

The map at the top places the four big companies and 48 suppliers. All but one of the suppliers come from Airbus’s public list of approved suppliers.[12] We do not name them.

See the map

More than four in five have at least one passage with a certification term. A line links each supplier to the big company it is most often named with.

For some suppliers, that link is most of what the files say about them. More than half of the passages that name one engineering firm also name Airbus.

Supplier documents use other words

The six terms come from the regulator. Suppliers write in workshop words: qualification test, acceptance test, first article inspection, certificate of conformity.

With these words added, the suppliers’ matches about double. Seven suppliers in ten gain matches.

Supplier matches, by the words searched
  • The six regulator terms 1
  • With workshop words added about 2 times

Seven suppliers in ten gain matches.

These words are generic too. Other industries write acceptance tests. So a match is something to check, not a finding.

What these findings are not

  • A match is two strings in one passage. It is not a certification file.
  • Being named does not mean a company was breached. The files can come from another organisation.
  • The map ranks companies. It does not measure them.
  • Nobody can see who downloaded published files.

The rules and the limits are on a separate page: How we count.

If you are a supplier

You cannot fix a breach at someone else’s company. Four things are in your hands.

  1. List who holds your evidence. Test laboratories, engineering contractors, equipment makers. Your documents can come out of any of them without your systems being touched.
  2. Limit the working copies. Contractors keep drafts and test reports after a project ends. Ask for their return or their deletion.
  3. Ask when a supplier is hit. The useful question is which of your documents were in its published files. The supplier is rarely able to answer quickly.
  4. Search what is published. Do not wait for a customer to ask. Five searches cover most of it.

Five searches

A supplier’s publication rarely names you in its title. So search inside the published files, with these five queries.

  1. Your company name: "Your Company"
    It shows whether anything names you at all.
  2. Your name with your main customer: "Your Company" Airbus
    These are the documents your customer will ask you about.
  3. Your name with a workshop term: "Your Company" "qualification test"
    Then "acceptance test", "first article inspection" and "certificate of conformity", one at a time.
  4. A part number or a project code, without your name: "12345-678-01"
    Documents about your parts sit in other companies’ files. Type the reference exactly as written, inside quotes.
  5. Your critical suppliers: "Supplier Name"
    Their published files can hold your documents.

What to do with the result

If a search returns something, look first at what kind of document it is. A contract, an invoice and a payroll file do not call for the same answer.

List the customers and programmes named, and tell your customer first. It is better that they hear it from you.

Change what can be changed. Passwords and keys can be replaced. A published document cannot be recalled: treat it as public.

If a search returns nothing, that is good news, not a certificate. Run the searches again every month.

Where to run them

These searches run on OwlyScan’s free search, with no account. It has a daily limit, so start with searches 1, 2 and 4.

It shows how many records match and up to six examples, with other organisations’ details hidden. Reading the full records that name your company takes an account.

Questions

Does being named in published files mean my company was breached?

No. A passage that names a company can come from the files of another organisation: a supplier, a contractor, a customer. Being named means that documents about you are in circulation, whoever lost them.

Why does a ransomware attack on a supplier concern its customers?

Because a supplier holds its customers’ documents: drawings, test reports, contracts. When its files are published, theirs are published with them. This is the supply chain risk that this study looks at.

How do I check if my company is in files published by a ransomware group?

Search your company name, then your name with a customer, a workshop term or a part number. A supplier’s publication rarely names you in its title, so search inside the published files. The five searches above show how.

What counts as a certification term?

Six terms: EASA, type certificate, Part 21 and test report, and the French forms certificat de type and rapport d’essai. A passage is counted when it holds one of them and the exact company name.

Why are suppliers not named on this page?

Because a count is not a proof. We show a supplier’s activity, its region and the big company it is most often named with. Only the supplier itself should look further.

What is AirCyber?

AirCyber is the cybersecurity maturity standard of the aerospace and defence sector, with three levels: Bronze, Silver and Gold. GIFAS uses it in the programme it announced in July 2026.

Is the C919 certified in Europe?

Not on the date of this page. In April 2025, EASA’s executive director said it may take three to six years. Counted from 2025, that gives a window between 2028 and 2031, as Air Journal noted in July 2026.

Method in brief

We searched the OwlyScan index in November 2026. It holds more than 160 million passages. Almost all of the matches come from ransomware publication sites.

A passage is counted when it holds the exact company name and one term. The ten aerospace names are the four big companies and six of their suppliers. The comparison set is ten large French companies in food, retail and pharmaceuticals.

The rules and the limits are on a separate page: How we count.

Sources

  1. AviTrader, 29 April 2025, "EASA: COMAC’s C919 certification could take up to six years". https://avitrader.com/2025/04/29/easa-comacs-c919-certification-could-take-up-to-six-years/
  2. EASA, press release of 3 September 2020, "EASA and China’s CAAC start a new era of cooperation". https://www.easa.europa.eu/en/newsroom-and-events/press-releases/easa-and-chinas-caac-start-new-era-cooperation
  3. Air Journal, 27 July 2026, on the EASA test flights of the C919 (in French). https://www.air-journal.fr/2026-07-27-c919-les-pilotes-dessai-europeens-ne-relevent-aucun-risque-materiel-majeur-5276552.html
  4. EASA, "Aircraft certification": the four steps of type certification. https://www.easa.europa.eu/en/domains/aircraft-products/aircraft-certification
  5. IndustryWeek, 31 October 2018, on the indictment of ten Chinese nationals. https://www.industryweek.com/companies-executives/us-indicts-10-chinese-over-scheme-steal-aerospace-tech
  6. CERT-EU, threat memo 190927-2 of 27 September 2019, summarising the AFP investigation on Airbus suppliers. https://cert.europa.eu/static/MEMO/2019/TLP-WHITE-CERT-EU-MEMO-190927-2.pdf
  7. CSO Online, 14 October 2019, on the CrowdStrike report about Turbine Panda. https://www.csoonline.com/article/567857/china-supported-c919-airliner-development-through-cyberespionage.html
  8. Nextgov, 17 November 2022, on the sentencing of Yanjun Xu. https://nextgov.com/technology-news/2022/11/extradited-chinese-national-sentenced-espionage-charges/379861
  9. SecurityWeek, 13 September 2023, report on the Airbus investigation. https://www.securityweek.com/airbus-launches-investigation-after-hacker-leaks-data/
  10. SecurityWeek, 14 November 2022, report on the Thales data published by a ransomware group. https://www.securityweek.com/thales-denies-getting-hacked-ransomware-gang-releases-gigabytes-data/
  11. GIFAS, 27 July 2026, "The French aerospace industry mobilises to strengthen cyber resilience across its supply chain". https://gifas.fr/en/news/the-french-aerospace-industry-mobilises-to-strengthen-cyber-resilience-across-its-supply-chain-july-2026
  12. Airbus, Approved Suppliers List (as of November 2026), from the "Airbus supplier documents" page, read on 13 November 2026. https://info.airbus.com/en/airbus-supplier-documents

Go further