European Commission Reports Cyber Intrusion and Data Theft

Summary

The European Commission confirmed a cyberattack on its cloud infrastructure hosting the Europa.eu platform, with the ShinyHunters group claiming to have stolen over 350GB of data including emails, databases, and confidential documents. AWS stated it did not experience a security event, indicating the attackers exploited a compromised account or misconfiguration rather than an AWS vulnerability. This is the second data breach confirmed by the EC in 2025, following a February intrusion into Commission IT infrastructure.

Full text

The European Commission, the EU’s executive branch, has confirmed being targeted in a cyberattack that impacted its cloud infrastructure, as hackers claimed to have stolen hundreds of gigabytes of data. In a statement issued on Friday, the European Commission (EC) said the attack affected cloud infrastructure hosting its web presence on the Europa.eu platform, but noted that its public websites were not disrupted. “Early findings of our ongoing investigation suggest that data have been taken from those websites. The Commission is duly notifying the Union entities who might have been affected by the incident. The Commission’s services are still investigating the full impact of the incident,” the Commission stated. It added, “The Commission’s internal systems were not affected by the cyber-attack.” European Commission hacked A message posted over the weekend on the website of the ShinyHunters cyber extortion group claimed more than 350GB of data were stolen, “including data dumps of mail servers, databases, confidential documents, contracts, and much more sensitive material”. Bleeping Computer learned from the hackers that they targeted the EC’s AWS accounts. AWS stated that it “did not experience a security event”, noting that its services “operated as designed”.Advertisement. Scroll to continue reading. This statement indicates that the attackers leveraged a compromised account or a security misconfiguration to gain access to the Commission’s systems, rather than by exploiting a vulnerability in AWS products or services. This is the second data breach confirmed by the EC this year. In February, CERT-EU reported discovering evidence of an intrusion into the Commission’s IT infrastructure, with hackers potentially accessing personal information belonging to some staff members. Related: Poland Faced a Surge in Cyberattacks in 2025, Including a Major Assault on the Energy Sector Related: EU Sanctions Chinese, Iranian Firms Supporting Hacking Operations Related: EU Plans Phase Out of High Risk Telecom Suppliers, in Proposals Seen as Targeting China Related: Traveler Information Stolen in Eurail Data Breach Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. More from Eduard Kovacs CISA Flags Critical PTC Vulnerability That Had German Police MobilizedAlleged RedLine Malware Administrator Extradited to USDell and HP Roll Out Quantum-Resistant Device SecurityRussian Cybercriminal Gets 2-Year Prison Sentence in US US Prisons Russian Access Broker for Aiding Ransomware AttacksHackerOne Employee Data Exposed in Massive Navia BreachStryker Says Malicious File Found During Probe Into Iran-Linked AttackM-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds Latest News Russian APT Star Blizzard Adopts DarkSword iOS Exploit KitHacked Hospitals, Hidden Spyware: Iran Conflict Shows How Digital Fight Is Ingrained in WarfareTelnyx Targeted in Growing TeamPCP Supply Chain AttackExploitation of Fresh Citrix NetScaler Vulnerability BeginsFBI Confirms Kash Patel Email Hack as US Offers $10M Reward for HackersF5 BIG-IP DoS Flaw Upgraded to Critical RCE, Now Exploited in the WildCloudflare-Themed ClickFix Attack Drops Infiniti Stealer on MacsPro-Iranian Hacking Group Claims Credit for Hack of FBI Director Kash Patel’s Personal Account Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Securing Fragile OT in an Exposed World March 10, 2026 Get a candid look at the current OT threat landscape as we move past "doom and gloom" to discuss the mechanics of modern OT exposure. Register Webinar: Why Automated Pentesting Alone Is Not Enough April 7, 2026 Join our live diagnostic session to expose hidden coverage gaps and shift from flawed tool-level evaluations to a comprehensive, program-level validation discipline. Register People on the MoveModerna has promoted Farzan Karimi to Deputy Chief Information Security Officer.Brian Goldfarb has been appointed Chief Marketing Officer at SentinelOne.Token has appointed Katy Nelson as Chief Revenue Officer.More People On The MoveExpert Insights Why Agentic AI Systems Need Better Governance – Lessons from OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) The Human IOC: Why Security Professionals Struggle with Social Vetting Applying SOC-level rigor to the rumors, politics, and 'human intel' can make or break a security team. (Joshua Goldfarb) How to 10x Your Vulnerability Management Program in the Agentic Era The evolution of vulnerability management in the agentic era is characterized by continuous telemetry, contextual prioritization and the ultimate goal of agentic remediation. (Nadir Izrael) SIM Swaps Expose a Critical Flaw in Identity Security SIM swap attacks exploit misplaced trust in phone numbers and human processes to bypass authentication controls and seize high-value accounts. (Torsten George) Four Risks Boards Cannot Treat as Background Noise The goal isn’t about preventing every attack but about keeping the business running when attacks succeed. (Steve Durbin) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — ShinyHunters