European Commission Confirms Data Breach After ShinyHunters Publish Stolen Europa.eu Records
The European Commission confirms a breach of its AWS-hosted Europa.eu platform after ShinyHunters published over 90 GB of stolen data. CERT-EU traces the intrusion to a supply chain attack on the Trivy security scanner.
The European Commission confirmed on March 30, 2026, that attackers had breached at least one Amazon Web Services account underpinning its Europa.eu web platform and stolen data belonging to the bloc’s executive arm. The acknowledgment came days after the ShinyHunters cyber-extortion group published samples of what it claims is more than 350 gigabytes of exfiltrated material on its dark-web leak site.
CERT-EU, the European Union’s dedicated cybersecurity response team, attributed the initial intrusion to a separate cybercrime group known as TeamPCP and said ShinyHunters was responsible for the subsequent public leak of stolen data. The distinction matters because it suggests a hand-off between the group that performed the technical compromise and the one that chose to weaponize it for extortion.
Supply Chain Vector Through Trivy
The breach traces back to March 19, 2026, when attackers obtained an AWS API key that granted access to Commission cloud accounts. According to CERT-EU’s preliminary findings, the key was compromised through a supply chain attack on Trivy, an open-source container vulnerability scanner maintained by Aqua Security. The Commission had inadvertently deployed a tampered version of the tool during the window in which the Trivy project itself was compromised.
Once inside, the attackers used TruffleHog, a credential-scanning tool, to locate and validate additional AWS credentials via the Security Token Service. They then created new access keys attached to an existing user account and conducted reconnaissance across the Commission’s cloud environment. CERT-EU noted that the technique mirrors activity previously linked to TeamPCP, which has been connected to recent compromises of several open-source projects including KICS, LiteLLM, and Telnyx.
Scope of Stolen Data
ShinyHunters published roughly 90 gigabytes of compressed data while claiming to hold more than 350 gigabytes in total. The published material includes approximately 51,992 files related to outbound email communications totaling 2.22 gigabytes, along with names, usernames, and email addresses primarily associated with Europa.eu websites.
The group also claimed to possess DKIM email-signing keys, internal admin URLs, NextCloud collaboration platform data, and documents related to the Athena military financing mechanism. Separately, Infosecurity Magazine reported that the leaked trove contained employee personally identifiable information and single sign-on directory data, though the Commission has not confirmed these specific claims.
Commission Downplays Impact
Commission spokesperson Thomas Regnier characterized the compromise as limited, stating that the organization’s defense systems “immediately detected the malicious activities” and that internal infrastructure was “absolutely not affected.” He suggested that the compromised information was “potentially already in the public domain,” a framing that several security researchers have challenged.
“A quiet leak can be just as damaging for trust, diplomacy, and ongoing investigations,” noted security analyst Nick Tausek, as reported by Infosecurity Magazine.
The timeline shows that the Commission’s Security Operations Center detected the breach on March 24 — five days after initial access — and notified CERT-EU the following day. Compromised account rights were immediately revoked and all affected access keys were deactivated or deleted. CERT-EU said no lateral movement to other AWS accounts was detected, though the investigation remains ongoing.
Second Major Incident in Months
The breach marks the Commission’s second significant cybersecurity incident in recent months, following a February 2026 compromise involving its mobile device management systems. The repeated targeting underscores the challenges facing large governmental bodies whose sprawling digital infrastructure increasingly depends on third-party open-source tools and cloud services.
ShinyHunters stated publicly that it would “not extort” the Commission, a tactic that security experts interpret as a deliberate strategy to maximize reputational damage rather than financial gain. The group has historically targeted high-profile organizations and several of its members have faced arrests in connection with prior campaigns.