Leak at Europa (European Commission)

On 24 March 2026, the European Commission — the EU's executive body, whose public websites run on the shared Europa.eu hosting platform — detected a breach of part of its cloud infrastructure. The compromise originated upstream: on 19 March, attackers obtained an Amazon Web Services (AWS) secret key through the Trivy supply-chain compromise (attributed to the threat actor TeamPCP). That key gave control over an AWS account that powers a large portion of the Commission's public-facing web systems.

Using the stolen credentials, the attackers exfiltrated roughly 91.7 GB of compressed data (about 340 GB uncompressed) drawn from the web-hosting environment. The dataset affected dozens of client services — around 42 internal Commission entities and at least 29 other EU bodies hosted on the same platform. On 28 March 2026, the data-extortion group ShinyHunters published the stolen data on its dark-web leak site.

Exposed data categories included:

• Names, surnames, usernames and email addresses
• Email communications (roughly 51,992 files / 2.22 GB of email content and notifications)
• Database records and user-submitted form data from hosted websites
• Confidential documents and contracts

The Commission stated that its internal systems were not touched and that the impact was limited to the public web-hosting infrastructure. In response, the compromised AWS credentials were revoked and the attacker's access disabled, while CERT-EU and the affected entities continued analysing the exposed databases. The incident was disclosed publicly via Commission press release on 27 March 2026.