{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreih75xuyivbzedsmunbq62rpo445a3xq6whewusulggw2knxouivu4",
    "uri": "at://did:plc:qzjwstutqk2cy7df7jbzd2hx/app.bsky.feed.post/3mi3gxsmt56a2"
  },
  "coverImage": {
    "$type": "blob",
    "ref": {
      "$link": "bafkreiczw6kk2n6fihbwyuazwy3u2br2kfzpgzcu7hmj6eoxwn33jhkrpy"
    },
    "mimeType": "image/jpeg",
    "size": 5421640
  },
  "path": "/article/4151383/european-commission-data-stolen-in-a-cyberattack-on-the-infrastructure-hosting-its-web-sites-2.html",
  "publishedAt": "2026-03-27T21:18:58.000Z",
  "site": "https://www.networkworld.com",
  "tags": [
    "Cloud Security, Cyberattacks, Cybercrime, Data Breach, Security",
    "revealed there had been an attack",
    "reported",
    "revealed on January 30",
    "Kellman Meghu",
    "Ilia Kolochenko",
    "CSOonline"
  ],
  "textContent": "The European Commission is continuing to investigate the theft of data from its cloud infrastructure earlier this week.\n\nOn Thursday, the Commission revealed there had been an attack on its Europa.eu platform, offering few details, then, on Friday, security news site Bleeping Computer reported that the attack had involved the compromise of an account or accounts on Amazon Web Services (AWS).\n\nThe news site said an unnamed threat actor who claimed responsibility told it that they had stolen over 350GB of Commission data, and had shown the reporter several screenshots as evidence.\n\nThe hacker also said they will leak the data, rather than try to extort the Commission.\n\nCSO asked a spokesperson for the Commission for comment, but no reply was received by our deadline.\n\nFor its part, Amazon said, “AWS did not experience a security event, and our services operated as designed.”\n\nThe Commission said the Europa websites remain available, and that its “swift response ensured the incident was contained and risk mitigation measures were implemented to protect services and data.” Its internal systems weren’t affected by the attack, the statement added.\n\nThe incident comes after the Commission revealed on January 30 that its central infrastructure for managing mobile devices had “identified traces of a cyber attack” which may have exposed names and mobile number of some staff.\n\n## IAM is hard\n\nThe lack of information about the attack makes it hard for security industry experts to comment. For one thing, it’s unknown how the breach of security controls happened: Did the threat actor take advantage of an unpatched software or hardware vulnerability, find a zero day, or did an employee fall for a phishing attack?\n\n“There is very little info out,” said Kellman Meghu, chief technology officer of Canadian incident response firm DeepCove Cybersecurity, “but this does sound bad. This is why I force all my users to use AWS Identity Center sign on. No IAM-generated keys, and admin accounts are only activated through a ‘break glass’ strategy, where two people are needed to authenticate.”\n\nBy “break glass” strategy, Meghu said he meant that the AWS root/admin account that controls all of an organization’s cloud infrastructure is stored outside of AWS on a system that requires authorization from both the CEO and CTO, via credentials and hardware tokens. This access generates an alert, so if there was an unauthorized attempt to sign in, the CEO and CTO would know.\n\n“I personally live in constant fear of this sort of thing happening” he said. “I create multiple separate AWS accounts using the AWS Organizations feature so accounts are completely isolated from each other. For example, there can be a ‘dev ORG’ for testing with no real data, and a ‘uat ORG’ for user testing with some data, and a ‘prod ORG’ where no one is allowed. You can also break things down so different application types get their own Organizations, which limits lateral movement. Azure has similar setup and options, which are called Tenants.\n\n“The reality is, identity access management (IAM) is hard, and not just in AWS,” he added. “[It’s] the same challenge with all infrastructure. [Microsoft] Entra ID scares me just as much. How do we guarantee the authorized person has legitimate access? It only takes one mistake.”\n\n## A ‘grim warning’\n\nIlia Kolochenko, CEO of Swiss-based ImmuniWeb, said that while the attack “may appear to be pretty banal on its face, there are several things to pay attention to.”\n\nReferring to the Bleeping Computer report, he said that, given that the attackers allegedly plan to release the data, their key intention here is to visibly hurt and to cause reputational damage.\n\n“The attackers behind are either hacktivists or cyber mercenaries hired by a nation state,” he concluded. “In view of the geopolitical turbulence around the globe, such attacks will probably surge in 2026. The problem is that in such cases, attackers rarely consider their costs and may persistently invest time and efforts in sophisticated hacking campaigns against the most protected organizations. Organizations should urgently prepare themselves for an avalanche of politically motivated attacks with highly destructive consequences this year.”\n\nCombined with the previous history of similar incidents impacting the European Commission and other EU bodies, this incident “is a grim warning that the European regulation of cybersecurity, that some experts perceive as excessive and unnecessarily complicated, is not a panacea against data breaches,” he added. “Whilst cloud data breaches are quite widespread, and have already affected thousands of large organizations in 2026, this incident may be leveraged by the opponents of further overregulation of the European data protection landscape.”\n\nKolochenko also said that European companies may utilize this incident to promote digital sovereignty and “EU-made” cloud. “While data storage in Europe, under management of European cloud providers, will quite unlikely make any material change of cloud security landscape, some organizations may be tempted leave American vendors in favor of their European competitors,” he said.\n\n_This article originally appeared on CSOonline._",
  "title": "European Commission data stolen in a cyberattack on the infrastructure hosting its web sites"
}