Loading story…
The European Commission is investigating a breach after a threat actor gained unauthorized access to its Amazon cloud infrastructure and at least one account used to manage that environment. According to reports, the intrusion was detected quickly by the Commission’s cybersecurity incident response team, but the actor claims to have exfiltrated more than 350 GB of data, including multiple databases. Screenshots shared with reporters allegedly show access to European Commission employee information and an email server used by staff.
The actor reportedly said they do not intend to extort the Commission and instead plan to leak the stolen data later. The incident adds to a recent string of security problems at European institutions: the Commission had already disclosed a separate breach tied to a compromised mobile device management platform, apparently linked to exploitation of Ivanti Endpoint Manager Mobile code-injection vulnerabilities that affected other organizations in the region as well.
See attribution, scope, and your downstream exposure.
9 events from the most recent confirmed update back to the earliest known activity.
CERT-EU said the European Commission's AWS cloud breach was carried out by TeamPCP, which used a compromised AWS API key stolen in the Trivy supply-chain attack to access the environment on March 10. CERT-EU also said the incident potentially exposed data from 42 internal Commission clients and at least 29 other EU entities using the europa.eu hosting service.
After claiming the Europa.eu breach, ShinyHunters added the European Commission to its leak site and released an archive of more than 90 GB of allegedly stolen files. The group said the material included mail server dumps, databases, confidential documents, and contracts.
The European Commission said early findings from its investigation indicate some data may have been exfiltrated from the cloud infrastructure hosting Europa.eu websites. It also said potentially affected EU entities are being notified while the investigation continues.
The European Commission publicly confirmed a cyberattack affecting part of its cloud infrastructure, specifically systems hosting its Europa.eu web presence. It said internal systems were not affected, that containment and risk mitigation measures were taken immediately, and that the investigation was ongoing.
The European Commission's cybersecurity incident response team detected the Amazon cloud intrusion quickly and began investigating the breach. The threat actor said they did not plan to extort the Commission and instead intended to leak the allegedly stolen data later.
A threat actor obtained unauthorized access to the European Commission's Amazon cloud infrastructure and at least one account used to manage that environment. The actor later claimed to have stolen more than 350 GB of data, including databases, employee information, and access to a staff email server.
The European Commission said it discovered a cyberattack on 24 March affecting the cloud infrastructure hosting its Europa.eu web presence. It took immediate containment and mitigation measures, kept the websites available, and initially found no impact on internal systems.
In February, the European Commission disclosed a separate breach tied to the January 30 compromise of its mobile device management platform. Reporting indicated the incident was part of wider exploitation affecting other European institutions.
The European Commission discovered a compromise affecting a mobile device management platform on January 30. This incident was later linked to broader attacks on European institutions exploiting code-injection vulnerabilities in Ivanti Endpoint Manager Mobile.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
33 references tracked. Mallory keeps watching after this page renders.
cybersecurityintelligence.com
Open sourcezdnet.fr
Open sourcethenextweb.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceec.europa.eu
Open sourceinfosec.pub
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Commission disclosed a cyberattack affecting cloud infrastructure used to host websites on the `Europa.eu` platform, saying early findings indicate data was stolen from at least one AWS account in its environment. The Commission said it detected the incident on March 24 and took immediate containment measures, while stressing that its internal systems were not compromised and that AWS infrastructure itself was unaffected. It is notifying potentially affected Union entities and continues to investigate the scope and impact of the breach. Subsequent reporting linked the intrusion to **ShinyHunters**, which allegedly claimed to have taken more than **350GB** of data, including databases, and to still have access to a Commission email server. The cloud breach followed another security incident reported earlier in the year involving European Commission staff mobile devices and a mobile device management environment, with that separate intrusion reportedly associated with exploitation of **Ivanti EPMM**. Together, the incidents have intensified scrutiny of the Commission’s security posture across both cloud-hosted services and employee device management systems.
Jun 29, 2026
The **European Commission** disclosed it is investigating a breach after detecting traces of an attack against its central **mobile device management (MDM)** infrastructure used to administer staff mobile devices. The Commission said the incident was contained and the system cleaned within **nine hours**, and it has not found evidence that managed mobile devices themselves were compromised; however, attackers may have accessed limited staff personal data such as **names and mobile phone numbers**. The activity appears consistent with a broader set of intrusions affecting European public-sector bodies tied to vulnerabilities in **Ivanti Endpoint Manager Mobile (EPMM)**. Dutch authorities reported that the **Dutch Data Protection Authority** and the **Council for the Judiciary/Justice** experienced nearly identical breaches in which unauthorized parties exploited an Ivanti EPMM software flaw to access employee data, including **names, email addresses, and phone numbers**, suggesting a shared exploitation vector across multiple European institutions’ MDM deployments.
Jun 29, 2026
The European Space Agency (ESA) confirmed a data breach after a threat actor claimed to have accessed and exfiltrated over 200 GB of sensitive data from external servers. The attacker, using the alias "888," advertised the stolen data for sale on BreachForums, providing screenshots as proof and claiming to have obtained source code, confidential documents, credentials, API tokens, configuration files, and a dump of private Bitbucket repositories. ESA stated that the incident affected only a small number of external servers used for unclassified engineering and scientific collaboration, and emphasized that the breach did not impact its core corporate network. The agency has initiated a forensic investigation, implemented containment measures, and notified relevant stakeholders, while continuing to assess the full scope of the compromise. The breach was first detected when the attacker announced the sale of the data on December 18, 2025, and maintained access to the compromised servers for about a week. ESA has publicly acknowledged the incident and is providing updates as the investigation progresses. The organization has reassured the public that the affected servers were not part of its main infrastructure and that the impact appears limited, though the full extent of the data exposure is still under review. The incident highlights ongoing threats to scientific and engineering organizations from cybercriminals seeking to monetize stolen intellectual property and sensitive information.
Jun 29, 2026