CERT-EU Attributes European Commission AWS Breach to TeamPCP
Summary
CERT-EU attributes the European Commission’s March AWS breach to TeamPCP, with high confidence that attackers gained access through a compromised Trivy package and stolen API key. About 92 GB of data was taken; no lateral movement was identified.
Key points
- CERT-EU says attackers accessed the Commission’s AWS account on March 19 through the Europa[.]eu platform, using a compromised Trivy package and a secret Amazon API key.
- About 92 GB of compressed data was taken, including names, email addresses, and some email content.
- The data included nearly 52,000 outbound-email-related files; CERT-EU said most were automated, while some bounceback notices could expose personal data.
- Data belonging to 42 internal clients and at least 29 EU entities may have been affected.
- CERT-EU said the stolen dataset appeared on ShinyHunters’ dark web site on March 28; ShinyHunters separately claimed it contained mail-server dumps and other sensitive material.
- The compromised API key had management rights that could have enabled access to other Commission AWS accounts, but CERT-EU reported no evidence of lateral movement.
Article Details
- Victim Organization
- European Commission
- Victim Domain
- europa.eu
- Incident Type
- Data breach involving a compromised Trivy supply chain and misuse of a stolen Amazon API key to access an AWS account and exfiltrate data.
- Data Types Exposed
- Names
- Email addresses
- Some email content
- Affected Records
- Data belonging to 42 internal clients and at least 29 EU entities may have been stolen. The dataset contained nearly 52,000 files related to outbound email; no count of individual records was disclosed.
- Affected Data Size
- Approximately 92 GB of compressed data. Nearly 52,000 outbound-email-related files accounted for 2.2 GB.
- Operational Impact
- Data was exfiltrated. The compromised API key had management rights that could have enabled movement to other European Commission AWS accounts, but CERT-EU reported no sign that this occurred. Some email bouncebacks may pose a risk of personal data exposure.
- Ransom Or Extortion
- No ransom demand was reported. The stolen dataset appeared on the ShinyHunters dark web site on March 28; ShinyHunters claimed it contained mail-server data, databases, confidential documents, contracts, and other sensitive material.
- Claim Status
- confirmed
MITRE ATT&CK
T1078.004 · Cloud AccountsAttackers used a stolen Amazon API key to access the Commission's AWS account.T1195.002 · Compromise Software Supply ChainCERT-EU attributed initial access with high confidence to the Trivy supply-chain compromise, involving use of a compromised version received through normal software updates.
Threat Actors
ShinyHuntersThe stolen dataset appeared on the ShinyHunters dark web site. ShinyHunters claimed the material included mail-server data, databases, confidential documents, contracts, and other sensitive material; the article does not independently confirm that full claim.TeamPCPCERT-EU attributed the breach to TeamPCP and assessed with high confidence that the attackers gained initial access through the Trivy supply-chain compromise attributed to the group.
Vendors
Products
AWSThe European Commission suffered a breach of its AWS-hosted Europa.eu platform in March, with CERT-EU attributing the incident to the hacking group TeamPCP, which exfiltrated roughly 92 GB of compressed data includingEuropa.euThe European Commission suffered a breach of its AWS-hosted Europa.eu platform in March, with CERT-EU attributing the incident to the hacking group TeamPCP, which exfiltrated roughly 92 GB of compressed data including