European Commission breach traced to Trivy supply-chain attack and a stolen AWS key

The European Commission confirmed in late March 2026 that data was stolen from the cloud environment behind its Europa.eu web platform, and the ShinyHunters extortion group published it. CERT-EU later traced the intrusion to a compromised release of Trivy, the open-source security scanner, which handed the attacker an AWS API key. For engineering teams this is the part that matters: a tool many of us run in CI with access to cloud credentials became the way in.

What happened

CERT-EU's 2 April write-up gives this timeline:

• 19 March: the attacker obtained an AWS API key through the Trivy supply-chain compromise, which Aqua Security attributes to a group called TeamPCP. The Commission had received the poisoned Trivy version through normal update channels. The same day, the attacker ran TruffleHog to look for more secrets and created a new access key on an existing IAM user to avoid detection.
• 24 March: the Commission's security operations centre received alerts about possible API misuse, account compromise and unusual traffic.
• 25 March: the Commission notified CERT-EU, secured the secret and disabled the new keys.
• 27 March: the Commission disclosed the incident publicly. It said Europa websites were not disrupted and its internal systems were not affected.
• 28 March: ShinyHunters published the stolen dataset on its leak site.

CERT-EU puts the haul at about 91.7 GB compressed (340 GB uncompressed). It includes names, usernames and email addresses, plus at least 51,992 outbound email files. Up to 71 Europa hosting clients are affected: 42 internal Commission clients and at least 29 other EU bodies. AWS said it "did not experience a security event". The attacker used a valid key, not a flaw in AWS.

The Trivy compromise itself was short. A malicious Trivy v0.69.4 was live on 19 March for about three hours. 75 tags of the aquasecurity/trivy-action GitHub Action were force-pushed to malicious commits for about 12 hours, and setup-trivy tags v0.2.0–v0.2.5 for about four. The payload read secrets from CI runners, including masked GitHub Actions secrets in runner memory, and sent them to the attackers.

Who is affected

• Users of Europa-hosted sites and the 71 hosting clients, whose personal data and email content may be in the leak. Expect targeted phishing that uses it.
• Any team that ran Trivy v0.69.4 (or Docker Hub v0.69.5/v0.69.6), trivy-action tags 0.0.1–0.34.2, or setup-trivy v0.2.0–v0.2.5 during the exposure windows. Treat every secret those jobs could reach as stolen.

What it means for developers and engineering teams

The chain is short: a CI job pulled a mutable tag, the tag pointed to attacker code, the code read the job's AWS key, and the key had enough permissions to reach production data and create more keys. Each link was a normal convenience, not a misconfiguration anyone would flag in review.

• Git tags are mutable. uses: aquasecurity/[email protected] runs whatever that tag points to today. Only a full commit SHA is immutable.
• Security tools run with high privilege. Scanners often get broad read access, registry tokens and cloud credentials, which makes them very attractive targets.
• Long-lived IAM user keys in CI let an attacker keep access. Here the attacker added a second key to an existing user. Short-lived OIDC role credentials would have expired, and creating keys would have needed permissions a scanner should not have.
• Detection worked, but five days late. Alerts on new access keys and unusual API calls are cheap to set up and would cut that gap.

What to do now

1. Check for exposure. Search workflow logs and image pulls for Trivy v0.69.4–v0.69.6, trivy-action ≤0.34.2 and setup-trivy v0.2.0–v0.2.5 between 19 and 22 March. Known-good versions are Trivy ≤0.69.3, trivy-action 0.35.0 and setup-trivy 0.2.6. Check Aqua's advisory for the current matrix.
2. Rotate everything those jobs could read: cloud keys, GitHub tokens, registry credentials, SSH keys and kube tokens. Look for unexpected public repositories named tpcp-docs in your GitHub org, which the malware used to exfiltrate data.
3. Pin actions to SHAs, for example uses: aquasecurity/trivy-action@<40-char-sha> # v0.35.0, and let Dependabot or Renovate update the pins.
4. Replace static AWS keys in CI with OIDC role assumption and deny iam:CreateAccessKey to CI roles. In an AWS Organization, apply it as an SCP.
5. Alert in CloudTrail on CreateAccessKey, bursts of sts:GetCallerIdentity (TruffleHog uses it to verify keys) and API calls from unfamiliar IPs or user agents.
6. Restrict egress from CI runners so a compromised step can't send data to arbitrary hosts.

Related on TechLogHub

• GitHub Actions vs GitLab CI: both support OIDC cloud credentials
• CI/CD
• Depna: dependency vulnerability scanning from lockfiles

Sources

• CERT-EU: European Commission cloud breach and the Trivy supply chain (2 April 2026)
• BleepingComputer: European Commission confirms data breach after Europa.eu hack
• SecurityWeek: European Commission reports cyber intrusion and data theft
• Security Affairs: breach exposed data of 30 EU entities, CERT-EU says
• SafeDep: Trivy supply-chain compromise, what happened and how to respond