The European Commission is continuing to investigate the theft of data from its cloud infrastructure earlier this week.
On Thursday, the Commission revealed there had been an attack on its Europa.eu platform, offering few details, then, on Friday, security news site Bleeping Computer reported that the attack had involved the compromise of an account or accounts on Amazon Web Services (AWS).
The news site said an unnamed threat actor who claimed responsibility told it that they had stolen over 350GB of Commission data, and had shown the reporter several screenshots as evidence.
The hacker also said they will leak the data, rather than try to extort the Commission.
CSO asked a spokesperson for the Commission for comment, but no reply was received by our deadline.
For its part, Amazon said, “AWS did not experience a security event, and our services operated as designed.”
The Commission said the Europa websites remain available, and that its “swift response ensured the incident was contained and risk mitigation measures were implemented to protect services and data.” Its internal systems weren’t affected by the attack, the statement added.
The incident comes after the Commission revealed on January 30 that its central infrastructure for managing mobile devices had “identified traces of a cyber attack” which may have exposed names and mobile number of some staff.
IAM is hard
The lack of information about the attack makes it hard for security industry experts to comment. For one thing, it’s unknown how the breach of security controls happened: Did the threat actor take advantage of an unpatched software or hardware vulnerability, find a zero day, or did an employee fall for a phishing attack?
“There is very little info out,” said Kellman Meghu, chief technology officer of Canadian incident response firm DeepCove Cybersecurity, “but this does sound bad. This is why I force all my users to use AWS Identity Center sign on. No IAM-generated keys, and admin accounts are only activated through a ‘break glass’ strategy, where two people are needed to authenticate.”
By “break glass” strategy, Meghu said he meant that the AWS root/admin account that controls all of an organization’s cloud infrastructure is stored outside of AWS on a system that requires authorization from both the CEO and CTO, via credentials and hardware tokens. This access generates an alert, so if there was an unauthorized attempt to sign in, the CEO and CTO would know.
“I personally live in constant fear of this sort of thing happening” he said. “I create multiple separate AWS accounts using the AWS Organizations feature so accounts are completely isolated from each other. For example, there can be a ‘dev ORG’ for testing with no real data, and a ‘uat ORG’ for user testing with some data, and a ‘prod ORG’ where no one is allowed. You can also break things down so different application types get their own Organizations, which limits lateral movement. Azure has similar setup and options, which are called Tenants.
“The reality is, identity access management (IAM) is hard, and not just in AWS,” he added. “[It’s] the same challenge with all infrastructure. [Microsoft] Entra ID scares me just as much. How do we guarantee the authorized person has legitimate access? It only takes one mistake.”
A ‘grim warning’
Ilia Kolochenko, CEO of Swiss-based ImmuniWeb, said that while the attack “may appear to be pretty banal on its face, there are several things to pay attention to.”
Referring to the Bleeping Computer report, he said that, given that the attackers allegedly plan to release the data, their key intention here is to visibly hurt and to cause reputational damage.
“The attackers behind are either hacktivists or cyber mercenaries hired by a nation state,” he concluded. “In view of the geopolitical turbulence around the globe, such attacks will probably surge in 2026. The problem is that in such cases, attackers rarely consider their costs and may persistently invest time and efforts in sophisticated hacking campaigns against the most protected organizations. Organizations should urgently prepare themselves for an avalanche of politically motivated attacks with highly destructive consequences this year.”
Combined with the previous history of similar incidents impacting the European Commission and other EU bodies, this incident “is a grim warning that the European regulation of cybersecurity, that some experts perceive as excessive and unnecessarily complicated, is not a panacea against data breaches,” he added. “Whilst cloud data breaches are quite widespread, and have already affected thousands of large organizations in 2026, this incident may be leveraged by the opponents of further overregulation of the European data protection landscape.”
Kolochenko also said that European companies may utilize this incident to promote digital sovereignty and “EU-made” cloud. “While data storage in Europe, under management of European cloud providers, will quite unlikely make any material change of cloud security landscape, some organizations may be tempted leave American vendors in favor of their European competitors,” he said.
