European Commission

Summary

The European Commission reported a cyberattack on its mobile device management infrastructure that was discovered and contained within nine hours, during which attackers accessed staff names and phone numbers but did not compromise any mobile devices. The incident, linked to a zero‑day vulnerability in a widely used endpoint management product, exposed limited contact information while leaving core systems operational, and no responsible group was publicly identified.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 20, 2026 the European Commission unveiled a revised Cybersecurity Act that highlighted the risk of relying on supply chain vendors from dubious foreign countries and proposed ways to identify and phase them out. On January 30, 2026 the Commission’s central infrastructure team that manages mobile devices detected signs of a cyberattack against its systems used for mobile device management. The attack, which lasted approximately nine hours, compromised staff names and mobile numbers but did not result in any direct compromise of mobile devices. The Commission’s cybersecurity arm CERT‑EU announced the discovery on the same day and stated that the incident was immediately contained and the affected systems were cleaned within nine hours. CERT‑EU noted that hackers might have accessed personal information such as names and phone numbers of some Commission staff members. The Commission disclosed the incident publicly on February 5, 2026, without naming the specific vulnerability or attacker, while Dark Reading later confirmed that the breach occurred through a zero‑day flaw in Ivanti Endpoint Manager Mobile. On February 5 the Finnish public managed services provider Valtori also disclosed a similar breach, noting it was caused by a vulnerability in a commercial mobile device management service that had been publicly disclosed on January 29. On February 6 the Dutch Data Protection Authority and the Council for the Judiciary reported their own breaches and explicitly identified Ivanti EPMM as the culprit.

Several weeks later, on March 24, 2026 the European Commission announced that it had been targeted by a cyberattack affecting its cloud infrastructure that hosts the Europa web platform. Early findings from the investigation indicated that data exfiltration may have occurred, although the Commission said it had contained the incident swiftly. The Commission did not attribute the March 24 attack to any particular group or individual and provided no further details about the specific data that might have been accessed. The statement emphasized that the response had limited the impact and restored normal operations. No additional information about the March 24 incident was provided in the available sources. The Commission’s handling of both events was described as part of its broader initiative to improve cybersecurity across European Union institutions, which includes the Cybersecurity Package introduced on January 20, 2026.

Sources

Sources available to members: 4 sources.