Compromised Trivy Update Led to European Commission Cloud Data Exposure
Summary
CERT-EU reportedly assesses with high confidence that a compromised Trivy update led to theft of an AWS management key and data exfiltration from European Commission cloud infrastructure. ShinyHunters published the dataset; up to 71 EU clients may be affected.
Key points
- CERT-EU investigators reportedly assess with high confidence that a supply-chain compromise of Trivy introduced a malicious update used in the Commission’s environment.
- The article says an AWS API key with management-level permissions was obtained on March 19 and used to access cloud resources.
- The attacker reportedly used TruffleHog to look for additional credentials and created a new access key linked to an existing user.
- About 91.7 GB of compressed data was reportedly exfiltrated; ShinyHunters published the dataset on March 28 and claimed it contained mail-server data, databases, and confidential documents.
- Early analysis reportedly found personal data, including names, usernames, and email addresses, and more than 51,000 files linked to outbound email communications.
- Data linked to up to 71 clients—including 42 Commission services and at least 29 other EU entities—may be affected through shared europa[.]eu hosting infrastructure.
- The Commission reportedly revoked or disabled exposed credentials, notified regulators and affected entities, and continues investigating; officials said there were no website alterations or service disruptions.
Article Details
- Victim Organization
- European Commission
- Victim Domain
- europa.eu
- Incident Type
- Supply-chain compromise involving a malicious Trivy update, followed by AWS credential compromise, cloud-resource access, and data exfiltration.
- Data Types Exposed
- Personal data, including names, usernames, and email addresses
- More than 51,000 files linked to outbound email communications; some bounce-back messages may contain original user-submitted content
- The dataset was claimed by ShinyHunters to include mail-server data, database dumps, confidential documents, and contracts
- Affected Data Size
- Approximately 91.7 GB compressed (roughly 340 GB uncompressed).
- Operational Impact
- Data linked to up to 71 clients—42 European Commission services and at least 29 other Union entities—may have been exposed. The article reports no website defacement, outage, alteration, or service disruption, and says the Commission's internal systems were not affected. Investigation of exposed databases continues.
- Ransom Or Extortion
- ShinyHunters, described as a data extortion group, published the dataset on its leak site and claimed it contained sensitive material. No ransom demand is reported.
- Claim Status
- confirmed
MITRE ATT&CK
T1078.004 · Cloud AccountsAn AWS API key with management-level permissions was used to access cloud resources.T1098.001 · Additional Cloud CredentialsThe attacker created a new access key tied to an existing user in an attempt to maintain access.T1195.002 · Compromise Software Supply ChainCERT-EU investigators said with high confidence that the breach began with a supply-chain compromise involving a malicious Trivy update.
Threat Actors
Vendors
Products
AWSThe European Commission cloud breach began when a compromised Trivy update and a single AWS credential allowed an attacker to access cloud resources and move laterally without triggering obvious outages.AWS Security Token Service (STS)The attacker attempted to uncover more credentials using TruffleHog, a tool designed to scan for secrets and validate access through AWS Security Token Service (STS).
Tools
TrivyThe European Commission cloud breach began when a compromised Trivy update and a single AWS credential allowed an attacker to access cloud resources and move laterally without triggering obvious outages.TruffleHogThe attacker attempted to uncover more credentials using TruffleHog, a tool designed to scan for secrets and validate access through AWS Security Token Service (STS).