European Commission

Summary

The European Commission experienced a cyberattack on its cloud infrastructure hosting the Europa.eu platform, leading to the exfiltration of data from the service. Investigators found that attackers obtained an AWS API key through a compromised version of the open‑source tool Trivy, which they used to access the organization’s Amazon Web Services environment and copy approximately ninety‑two gigabytes of compressed data containing names, email addresses and message contents. The stolen data was later published online by the ShinyHunters group, while other criminal groups such as Lapsus$ also claimed possession of portions of the material. The breach affected not only the organization but also data belonging to at least twenty‑nine other European Union entities that use the same cloud service, and the organization reported that it contained the incident quickly without disrupting the availability of its websites.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 24, 2026, the European Commission discovered a cyber‑attack that affected part of its cloud infrastructure hosting the Europa.eu platform, according to a spokesman who said the commission’s internal systems were not affected by the incident. The commission said it took immediate steps to investigate and contain the breach, and that its swift response ensured the incident was contained and risk mitigation measures were implemented to protect services and data without disrupting the availability of the Europa websites. Early findings of the ongoing investigation suggested that data had been taken from those websites, and the commission stated it was duly notifying the Union entities that might have been affected while its services continued to investigate the full impact of the incident.

The attack targeted the commission’s Amazon Web Services account, and investigators traced the breach to a supply‑chain compromise of the open‑source vulnerability scanner Trivy, which had been publicly attributed to the threat group TeamPCP by Aqua Security. By downloading a compromised version of Trivy, the attackers obtained an AWS API key that gave them control over the commission’s AWS environment, after which they used Trufflehog to discover additional credentials, conducted reconnaissance, and exfiltrated approximately 350 GB of data (91.7 GB compressed) that included personal names, email addresses, and message contents. The compromised AWS secret was used to create and attach a new access key to an existing user to evade detection, but the commission and CERT‑EU found no evidence that the attackers moved laterally to other AWS accounts belonging to the commission. The stolen data related to 42 internal commission clients and at least 29 other Union entities using the service, and after the initial compromise the data was passed to the extortion group ShinyHunters, which published it on the dark web on March 28, claiming to have over 350 GB of commission data including mail server dumps, databases, confidential documents, contracts and personally identifiable information of employees.

Earlier in January 2026 the commission had identified traces of a cyber attack on its central infrastructure for managing mobile devices that may have exposed names and mobile numbers of some staff, but the March incident was described as separate and limited to the cloud infrastructure hosting Europa.eu. Amazon Web Services stated that it did not experience a security event and that its services operated as designed, attributing the breach to compromised account credentials rather than a flaw in its own systems. The commission’s spokesperson Thomas Regnier confirmed that the attack had been detected and blocked, reiterating that internal systems remained unaffected and that the commission continued to monitor the situation while working with affected organizations to assess any further consequences.

Sources

Sources available to members: 7 sources.