Discovery Air Defence Services

Discovery Air Defence Services, also known as Discovery Air Defence Services, is a Canadian defence contractor that provides adversary air training services to multiple nations' armed forces. The company supplies simulated enemy aircraft, maintenance support, and experienced pilot personnel to enable realistic combat training for its clients. Its portfolio includes a contract with the United States Air Force focused on counter‑Russian training scenarios, highlighting its role in preparing allied forces for near‑peer threats. Headquartered in Canada, the firm operates within the defence aerospace sector as a specialist provider of aggressor training that helps customers develop tactics, techniques, and procedures against sophisticated adversaries.

The firm’s core competency lies in delivering adversary (aggressor) air operations, a niche that requires specialized aircraft, maintenance infrastructure, and highly trained pilots. By offering realistic threat replication, it helps allied forces refine their defensive and offensive capabilities in a controlled environment. Analysts have cited the company as an example of the defence supply chain’s exposure to cyber threats, noting that similar past incidents have highlighted broader security vulnerabilities among military contractors. This positioning underscores the importance of robust cyber‑defence measures for contractors that handle sensitive training data and operational details.

On May 11, 2022, Discovery Air Defence Services suffered a ransomware attack carried out by the LockBit group. LockBit claimed to have exfiltrated approximately 44 gigabytes of data from the company’s systems, including potentially sensitive contract and training information. The attackers threatened to release the stolen information unless a ransom was paid, creating concerns about the possible exposure of defence‑related data. The incident drew attention to the risks faced by defence contractors that hold classified or sensitive training‑related data, particularly those supporting allied readiness. LockBit, known for its ransomware‑as‑a‑service model, has been among the most active ransomware operators globally, frequently targeting organizations across multiple sectors.

The attack was publicly reported by The Record, which detailed LockBit’s claim and the potential implications for the defence sector. No further public disclosures about subsequent remediation or operational status have been made available in the cited source. As a Canadian‑based provider of adversary air training, the firm remains part of the broader defence industrial base that supports allied readiness. The incident serves as a case study of how ransomware threats can affect specialized defence service providers that rely on digital systems for flight scheduling, maintenance logs, and client communications. Continued vigilance in cybersecurity practices is essential for organizations operating in this sector to protect both their operational integrity and the sensitive information entrusted to them by government clients.