European Commission confirms data taken from AWS-hosted Europa web platform
The Commission says data was taken from cloud infrastructure hosting Europa sites; an attacker claims 350 GB. AWS says it wasn't breached. Lessons for teams.
In late March 2026 the European Commission confirmed that attackers had got into the cloud infrastructure hosting its Europa.eu websites and that "data have been taken". The attacker told reporters they had compromised a Commission AWS account and taken more than 350 GB. AWS said its own services weren't breached. For engineering teams it's a reminder of the shared responsibility model: the provider secures the cloud, and you secure your accounts, identities and data in it.
What happened
The Commission said it detected a cyberattack on 24 March 2026 against the cloud infrastructure hosting its Europa web platform. In a statement released on 27 March, it said the incident had been quickly contained, the websites stayed available, its internal systems weren't affected, and early findings suggested data had been taken from those websites. It said it was notifying EU entities that might be affected and would strengthen its defences.
Separately, a threat actor told BleepingComputer they had accessed at least one AWS account used to manage the Commission's cloud environment and stolen more than 350 GB, including several databases. They shared screenshots that appeared to show Commission employee data and access to an email server. They said they didn't plan to extort the Commission but would leak the data later. The Commission hasn't confirmed these figures, the attack vector hasn't been disclosed, and no group has been publicly attributed.
AWS told reporters it "did not experience a security event" and that its services operated as designed. That puts the problem on the customer side of the shared responsibility line.
This was the Commission's second publicly disclosed incident of the year. On 30 January 2026 it detected an attack on its mobile device management infrastructure, which was contained within nine hours and may have exposed some staff names and phone numbers. Reports linked that incident to Ivanti Endpoint Manager Mobile vulnerabilities. There's no public evidence connecting the two incidents.
Who is affected
- The Commission and EU entities whose data sat on the Europa web platform. The Commission said it was notifying them.
- Commission staff, if the attacker's claims about employee data and email access are accurate.
- No impact on AWS customers in general: AWS said its own services weren't breached.
What it means for developers and engineering teams
Most public cloud breaches don't involve hacking the provider. They come from customer-side problems: leaked access keys, console users without MFA, overly broad IAM roles, public storage, or compromised CI credentials that can assume deployment roles. We don't know which applied here, but the pattern in the claims (an account "used to manage" the environment, then bulk database access) fits a stolen or abused administrative identity.
Two architectural lessons stand out. First, blast radius: if one account can manage both a public website platform and databases holding staff data or reach an email server, one compromised identity exposes all of it. Separate AWS accounts per workload, with service control policies, limit how far an intruder can move. Second, detecting exfiltration: moving hundreds of gigabytes leaves traces in CloudTrail data events, VPC flow logs and billing, but only if someone collects them and alerts on unusual volume.
What to do now
- Audit long-lived credentials: run
aws iam generate-credential-reportand thenaws iam get-credential-report. Remove unused access keys and console users without MFA. - Use roles and federation (IAM Identity Center for people, OIDC for CI) instead of static keys.
- Separate workloads into accounts under AWS Organizations, and use SCPs to block risky actions such as disabling CloudTrail or sharing snapshots publicly.
- Turn on detection: an organisation-wide CloudTrail trail (check with
aws cloudtrail describe-trails), GuardDuty in every region (aws guardduty list-detectors) and S3 data events for buckets holding sensitive data. - Alert on bulk reads and data movement: unusual
GetObjectvolume, new snapshot copies or shares, and spikes in data transfer out. - Run IAM Access Analyzer to find resources shared outside your organisation, and enforce S3 Block Public Access at the account level.
Related on TechLogHub
- AWS vs GCP vs Azure: cloud platforms compared
- AWS S3 vs Cloudflare R2: object storage options
- Authorization: least privilege explained