Satellite cybersecurity incidents surged 118% in 2025, but there is no mandatory security standard for commercial satellites -- 37 vulnerabilities were found in widely-used open-source spacecraft control software

The Space Information Sharing and Analysis Center (Space ISAC) reported a 118% surge in space-related cyber incidents in 2025 compared to 2024, with approximately 117 publicly reported incidents from January through August 2025. At the DEF CON and Black Hat USA conferences in August 2025, white-hat hackers demonstrated 37 separate vulnerabilities in open-source software used by space agencies and companies to control satellites, including the ability to send commands that could fire thrusters and change a satellite's orbit. Roughly 25 space-sector organizations were targeted by ransomware groups in 2024. A Chinese state-sponsored campaign that initially breached U.S. telecoms (Verizon, AT&T, T-Mobile) extended to satellite communications providers including Viasat by mid-2025. Why it matters: Satellites lack mandatory cybersecurity standards, so operators implement security ad hoc based on internal risk assessments, so satellites launched with known-vulnerable software remain in orbit for 5-15 years without the ability to patch critical vulnerabilities, so state-sponsored attackers can exploit these vulnerabilities to disrupt or hijack satellite operations, so critical infrastructure including military communications, air traffic management, and maritime navigation becomes vulnerable to denial-of-service or manipulation attacks. The structural root cause is that no government agency has clear regulatory authority over satellite cybersecurity -- the FCC regulates spectrum, the FAA regulates launches, NOAA regulates remote sensing, and CISA handles critical infrastructure but has no space-specific mandate -- so satellite cybersecurity falls into a regulatory gap where each agency assumes another is responsible, and operators face no compliance requirement to meet any specific security standard before or after launch.