European Union: cyberattack on the Europa platform

On 27 March 2026, the European Commission — the executive branch of the European Union — confirmed it had been the victim of a cyberattack on the cloud infrastructure hosting its public Europa.eu web platform. The Commission said the intrusion, discovered on 24 March, was rapidly contained and that its internal systems were not affected, while acknowledging that early findings indicated data had been taken from the websites.

The extortion group ShinyHunters claimed responsibility, asserting it had exfiltrated more than 350 GB of material after compromising at least one of the Commission's cloud (AWS) accounts. The attackers published a leak archive of over 90 GB on a dark web extortion site. Because the affected platform hosts the web presence of numerous EU bodies, the incident took on a supply-chain character, with reporting indicating that around 30 Union entities may have been impacted; the Commission said it was notifying the entities potentially affected.

Data reportedly taken from the leaked environment included:

• Mail-server dumps
• Multiple databases
• Confidential documents and contracts
• Employee personal data

The Commission stated that Europa.eu websites remained operational with no service disruption, that it had implemented risk-mitigation measures, and that an investigation was ongoing to determine the full extent of the compromise. No individual victim count has been authoritatively confirmed.