European Commission: cloud breach at Europa.eu

The European Commission has confirmed a cyberattack on its cloud infrastructure that it detected on 24 March 2026, specifically on the AWS environment behind Europa.eu. The ShinyHunters hacking group has claimed responsibility and says it exfiltrated more than 350 GB of sensitive data. The incident hits one of the EU's central institutions and shows that government cloud environments are no exception.

What happened

The group claiming the attack is known for high-profile breaches at Ticketmaster, AT&T and other companies. The attackers say they got into the Commission's infrastructure through its AWS account, and they have published samples of the allegedly stolen data as proof.

The Commission has confirmed the attack but stresses that its internal systems were not affected and that the Europa.eu websites stayed online without interruption. The response was quick: containment measures were put in place, and affected EU bodies are being notified.

AWS itself denies any security incident within its own cloud environment. According to AWS, the compromise happened through the Commission's AWS account, not through AWS's own infrastructure.

What was allegedly stolen

According to the attackers, the stolen data includes:

• Mail server dumps and email attachments: the Commission's internal communication
• SSO user directory: a complete list of all users of the single sign-on system
• DKIM signing keys: private keys used to sign email for the Commission's domains
• AWS configuration snapshots: full insight into the cloud architecture
• NextCloud and Athena data: data from internal file and analytics platforms
• Internal admin URLs: access points to administrative systems

At the time of publication, whether these claims are entirely true was the subject of the ongoing investigation. Some data samples, however, were made public and judged plausible by security researchers.

Update of 20 October 2026: CERT-EU published an analysis of the incident on 2 April 2026. According to CERT-EU, the attackers obtained one of the Commission's AWS API keys on 19 March through a supply-chain attack on a widely used open-source vulnerability scanner. ShinyHunters published the data on 28 March: about 91.7 GB compressed (340 GB uncompressed). CERT-EU confirms, among other things, names, usernames and email addresses, plus at least 51,992 files from outbound email communication. Data relating to at least 29 other EU entities may also be affected. The analysis does not mention DKIM keys, an SSO directory or AWS configurations.

Why the impact reaches far beyond the EU

The most worrying aspect is not the sheer volume of data. It is the allegedly stolen DKIM keys and the SSO user directory.

DKIM keys make it possible to sign emails cryptographically on behalf of the compromised domain. Whoever holds these keys can send highly convincing phishing emails that email security systems classify as legitimate – signed by @europa.eu. The potential for targeted attacks on other authorities, partners or citizens is huge.

A complete SSO directory gives attackers a detailed map of all users, roles and potential points of attack. It is the basis for large-scale credential stuffing or spear-phishing campaigns.

AWS configuration snapshots are technical blueprints of the infrastructure: which services are running? Which IP ranges, security groups and IAM policies are active? Anyone who knows this data can search specifically for further vulnerabilities, including in other EU systems built in a similar way.

A structural problem, not an exception

This incident is not an isolated case. It reflects a deeper problem: public authorities and large organisations run increasingly complex cloud infrastructure, often with configurations that have grown over time, decentralised administration and insufficient monitoring of the actual attack surface.

The Commission runs one of Europe's largest web presences on AWS infrastructure. Anyone who loses track of their own cloud footprint also loses control of their attack surface.

The question that matters is not "Do we have a cloud?" but "Do we know what is exposed in our cloud?"

What organisations need to do now

Even though this attack hit an EU institution, the implications translate directly to companies:

• Cloud asset inventory: which AWS, Azure or GCP resources are reachable from outside? Are outdated or forgotten configurations checked continuously?
• Rotate DKIM keys and signing credentials: especially if third-party providers have access to your mail infrastructure.
• Audit SSO and IAM regularly: who has access to which systems – and who should no longer have it?
• Enable dark web monitoring: samples from this breach have already been published and may be circulating in relevant forums.

How blacklens.io helps

blacklens.io helps make exactly these blind spots visible: exposed cloud assets and misconfigurations are captured regularly, weekly by default and immediately on demand. If credentials from a breach like this one turn up in combolists or infostealer logs, Dark Web Monitoring detects them and automatically assigns them to your organisation's employees or customers, so you can respond proactively.