European Commission Confirms 340GB Data Theft in Trivy-Linked AWS Breach
Summary
CERT-EU says attackers used an API key exposed in the TeamPCP Trivy supply-chain attack to access an EC AWS account and exfiltrate 340GB of data tied to websites for up to 71 EU entities; credentials were revoked and rotated.
Key points
- The EC says the incident occurred March 24 and was disclosed March 27.
- Attackers accessed an EC AWS account using an API key compromised on March 19 in the TeamPCP Trivy supply-chain attack; the EC had received a compromised Trivy version through normal update channels.
- Using the key, attackers created and attached another access key, conducted reconnaissance, and attempted to discover additional secrets with TruffleHog.
- CERT-EU says attackers exfiltrated 340GB of uncompressed data related to websites serving up to 71 clients: 42 EC clients and at least 29 other EU entities.
- The data includes names, email addresses and usernames; some automated notifications may contain original user-submitted content. Analysis of website databases is ongoing.
- ShinyHunters added the stolen information to its Tor-based leak site on March 28.
- The EC revoked the compromised account’s rights, deactivated and rotated credentials, and notified data protection bodies. The EC said its internal systems were not affected.
Article Details
- Victim Organization
- European Commission
- Victim Domain
- Europa.eu
- Incident Type
- Cloud data breach involving use of an API key compromised in a Trivy supply chain attack
- Data Types Exposed
- Names
- Email addresses
- Usernames
- Original user-submitted content in some bounce-back notifications, potentially including personal information
- Affected Records
- Not disclosed. The article reports 51,992 files of automated notifications, not a total count of affected records.
- Affected Data Size
- 340GB of uncompressed data; the article also describes the amount as over 300GB.
- Operational Impact
- The attackers accessed an AWS account in the backend of the Europa.eu hosting service and exfiltrated data relating to websites hosted for up to 71 clients. The European Commission said its internal systems were not affected. No service disruption is reported.
- Ransom Or Extortion
- ShinyHunters added the stolen information to its Tor-based leak site on March 28. The article does not report a ransom demand.
- Claim Status
- confirmed
MITRE ATT&CK
T1078.004 · Cloud AccountsThe attackers used a compromised AWS API key to access a cloud account.T1098.001 · Additional Cloud CredentialsAccording to the article, the attackers created and attached a new access key to a user account.T1552.001 · Credentials In FilesThe threat actor attempted to discover additional secrets using TruffleHog.
Threat Actors
ShinyHuntersThe article identifies ShinyHunters as an extortion group and reports that it added the stolen information to its leak site. This is reported leak-site activity, not attribution of the original intrusion.TeamPCPThe article attributes the Trivy supply chain attack that compromised the API key to TeamPCP; the attackers then used the key in the European Commission breach.
Vendors
Products
Tools
TrivyThe European Commission (EC) has confirmed that hackers stole over 300GB of data from its AWS environment using an API key compromised in the Trivy supply chain attack.TruffleHogOn the same day, the threat actor attempted to discover additional secrets by launching TruffleHog, a tool commonly used for scanning secrets and validating AWS credentials by calling the Security Token Service (STS),”