European Commission Cloud Breach Exposes Data from 30 EU Entities, Linked to TeamPCP On March 27, 2026, CERT-EU disclosed a cybersecurity breach affecting the European Commission’s Amazon Web Services (AWS) cloud environment, exposing data from at least 30 EU entities. The attack, attributed to the TeamPCP threat group, was first detected by the Commission on March 24, though initial access occurred as early as March 10 via a compromised AWS API key. The breach stemmed from a supply-chain attack on Trivy, a vulnerability scanning tool, which was exploited to steal an AWS secret key on March 19. TeamPCP used this access to deploy TruffleHog, a credential-scanning tool, and created additional access keys to evade detection while conducting reconnaissance and data exfiltration. The group, known for targeting platforms like GitHub, PyPI, and Docker, has been linked to similar supply-chain compromises, including a malicious LiteLLM package used to distribute malware. By March 25, the Commission’s Cybersecurity Operations Centre (CSOC) identified unusual AWS API activity, prompting an investigation. While the breach did not disrupt website availability or affect internal Commission systems, 350GB of data including emails, databases, contracts, and personal information was stolen. On March 28, the ShinyHunters group leaked the stolen data, which included names, usernames, email addresses, and over 51,000 outbound emails, some containing user-submitted content. CERT-EU confirmed that 71 clients of the Europa web hosting service were impacted, including 42 European Commission entities and 29 other EU bodies. The Commission has notified affected parties and is conducting a full impact assessment, though no evidence suggests website tampering or device compromise. This incident follows a separate January 30 attack on the Commission’s mobile device management system, where attackers accessed limited staff data but failed to compromise devices. The EU continues to strengthen cybersecurity measures amid rising threats to critical institutions.

European Commission Hit by Major Supply-Chain Attack via Compromised Trivy Scanner On April 3, 2026, CERT-EU issued an advisory revealing a sophisticated supply-chain attack targeting the European Commission (EC) through a compromised version of Trivy, a widely used open-source vulnerability scanner. The threat actor, identified as TeamPCP, exploited a flaw in the tool’s continuous integration and continuous delivery (CI/CD) pipeline to harvest AWS API keys, enabling large-scale data exfiltration. The breach resulted in the theft of over 340 GB of uncompressed data, affecting 71 clients hosted on the Europa web hosting service, the EC’s primary digital platform. The attack underscores the growing risk of trusted open-source tools as vectors for cyber threats, particularly when integrated into critical infrastructure. CERT-EU’s findings highlight the severity of the incident, which leveraged a seemingly secure component to gain unauthorized access to sensitive cloud environments. No further details on the nature of the exfiltrated data or remediation efforts have been disclosed.

EU Commission Confirms Cyberattack on Europa.eu Cloud Infrastructure On 24 March, the European Commission detected a cyberattack targeting the cloud infrastructure hosting its Europa.eu web platform the primary online gateway for the Commission, European Parliament, Council of the EU, and other EU institutions. The attack was swiftly contained, with the Commission confirming that public access to EU websites remained uninterrupted while mitigation measures were implemented. Early findings indicate that data was exfiltrated from the affected systems, though the type and volume of compromised data remain undisclosed. The Commission has begun notifying potentially impacted EU entities but has not identified the attackers. Notably, the breach did not penetrate the Commission’s internal networks, which handle sensitive communications and operations. The incident underscores Europe’s escalating cyber threats, with ENISA (the EU’s cybersecurity agency) recently warning that the region is facing severe risks from both criminal gangs and state-backed hackers. While the investigation continues, the attack highlights vulnerabilities in shared digital infrastructure, even as the EU strengthens its defenses through regulations like the NIS2 Directive and the Cyber Solidarity Act. Though the UK is no longer an EU member, the breach serves as a reminder that cyber threats transcend borders, affecting governments and organizations operating in the same high-risk environment. The Commission’s response limiting disruption and isolating the breach demonstrates the value of segmented infrastructure and rapid incident containment.

EU Commission’s Europa Web Platform Hit by Cyberattack, Data Likely Stolen On March 24, the European Commission confirmed a cyberattack targeting its cloud infrastructure hosting the Europa web platform, a key portal for EU communications and services. The incident, detected and contained swiftly, is under investigation, with early findings indicating that data was exfiltrated from affected websites. The Commission stated that internal systems remained unaffected, though it did not disclose the scope of the stolen data or attribute the attack to any group or individual. The breach follows a pattern of rising cyber threats against EU institutions, with no further details provided on potential motives or methods used. The attack was publicly disclosed on March 27, as the Commission continues to assess the full impact. No disruption to critical operations has been reported. The incident underscores ongoing vulnerabilities in public-sector digital infrastructure amid geopolitical tensions.

EU Commission Investigates Cloud Breach After Threat Actor Steals 350GB of Data The European Commission is probing a security breach after a threat actor infiltrated its Amazon cloud infrastructure, gaining access to sensitive employee data. While the EU’s executive body has not publicly acknowledged the incident, sources confirmed to BleepingComputer that at least one account managing the compromised cloud environment was affected. The attack was swiftly detected, prompting the Commission’s cybersecurity incident response team to launch an investigation. The threat actor, who claimed responsibility, told BleepingComputer they exfiltrated over 350GB of data including multiple databases and provided screenshots as proof of access to employee information and an internal email server. Unlike typical ransomware attacks, the actor stated they have no plans to extort the Commission but intend to leak the data online at a later date. This breach follows a separate incident in January, when the Commission disclosed a hack of its mobile device management platform, linked to vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) software. Similar attacks targeted other European institutions, including Finland’s Valtori and the Dutch Data Protection Authority. The incidents coincide with heightened cybersecurity concerns in the EU. In January, the Commission proposed new legislation to bolster defenses against state-backed cyber threats, while the Council of the European Union recently sanctioned three Chinese and Iranian firms for cyberattacks on critical infrastructure.

EU Commission Detects Cyberattack on Mobile Device Management Systems On January 30, CERT-EU, the European Commission’s cybersecurity team, identified a cyberattack targeting the Commission’s IT infrastructure, specifically systems used for mobile device management. The incident was swiftly contained, with affected systems restored within nine hours. While no mobile devices were compromised, CERT-EU confirmed that hackers may have accessed personal data of some European Commission staff, including names and phone numbers. The agency is conducting a full review to strengthen cybersecurity measures and prevent future breaches. The European Commission emphasized its commitment to securing internal systems, framing the response as part of a broader EU initiative to bolster cybersecurity across all institutions. This effort aligns with the recently introduced Cybersecurity Package, announced on January 20, aimed at enhancing resilience against growing cyber and hybrid threats targeting critical services and democratic institutions. The incident follows recent cybersecurity breaches affecting other European entities, including the European Space Agency and major firms targeted by access system vulnerabilities.