European Commission Launches Investigation into Amazon Cloud Account Breach

European Union Investigates Security Breach in Amazon Cloud Environment

The European Commission, the primary executive body of the European Union, is currently looking into a security breach that occurred when a threat actor managed to gain unauthorized access to the Commission’s Amazon cloud environment.

Although the EU has not officially disclosed the incident, it has been reported that the breach impacted at least one of the Commission’s AWS (Amazon Web Services) accounts.

According to an AWS spokesperson, there was no security event on their end, and their services operated as intended during the breach.

Sources familiar with the situation have revealed that the attack was promptly identified, and the Commission’s cybersecurity incident response team is actively investigating the breach.

While details from the Commission are scarce, the threat actor responsible for the breach has communicated with BleepingComputer, claiming to have stolen over 350 GB of data, including multiple databases.

The threat actor has not disclosed the method used to breach the accounts but has shared screenshots as proof of access to information belonging to European Commission employees and an email server used by Commission staff.

Interestingly, the threat actor has stated that they do not plan to extort the Commission using the stolen data but intend to release it online at a later time.

Notably, the Commission had previously disclosed another data breach in February when it discovered a hack on the mobile device management platform used to oversee its staff’s devices.

The January incident seems to be connected to similar attacks on other European institutions, such as the Dutch Data Protection Authority and Valtori, a government agency of Finland’s Ministry of Finance, exploiting vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) software.

These recent security breaches follow the Commission’s proposal on January 20 for new cybersecurity legislation aimed at enhancing defenses against state-backed actors and cybercrime groups targeting Europe’s critical infrastructure.

Recently, the Council of the European Union imposed sanctions on three Chinese and Iranian companies for orchestrating cyberattacks on member states’ critical infrastructure.

Update March 27, 13:56 EDT: Added Amazon statement.