Trivy Supply-Chain Compromise Reportedly Exposed 340 GB of European Commission Data
Summary
The article reports that a compromised Trivy update exposed an AWS API key used to access European Commission-affiliated accounts. ShinyHunters published 91.7 GB of compressed data; at least 29 other Union entities may be affected.
Key points
- The article says attackers gained initial access through a compromised Trivy update attributed to TeamPCP.
- On March 19, 2026, attackers reportedly used the update to steal an AWS API key and access other European Commission-affiliated AWS accounts.
- The article says ShinyHunters published about 91.7 GB compressed (340 GB raw) of data on March 28.
- Reportedly exposed material includes mail-server data, databases, contracts, names, usernames, and email addresses; more than 51,000 files related to outbound email were taken.
- Data concerning at least 29 other Union entities may be affected; the article says the Commission’s internal systems remained untouched.
- The Commission reportedly revoked access keys and notified data protection authorities. CERT-EU advised updating Trivy, rotating potentially exposed credentials, pinning GitHub Actions to full SHA hashes, and monitoring CI/CD activity.
Article Details
- Victim Organization
- European Commission
- Victim Domain
- europa.eu
- Incident Type
- Supply-chain compromise of Trivy used to steal an AWS API key, access affiliated AWS accounts, and exfiltrate data.
- Incident Date
- 2026-03-19
- Data Types Exposed
- Names
- Usernames
- Email addresses
- Outbound email files, some of which may contain user-submitted content
- Mail server data
- Database data
- Confidential documents
- Contracts
- Affected Records
- Not disclosed
- Affected Data Size
- Approximately 91.7 GB compressed (340 GB raw).
- Operational Impact
- Access keys were revoked and data protection authorities were notified. The article reports that the Commission’s internal systems remained untouched; the public-facing platform and affiliated AWS accounts were affected. Data pertaining to at least 29 other Union entities may also be affected.
- Ransom Or Extortion
- ShinyHunters published the stolen dataset on its leak site on March 28. The article does not report a ransom demand.
- Claim Status
- confirmed
MITRE ATT&CK
Threat Actors
ShinyHuntersDescribed as an extortion group that published the stolen dataset on its leak site; the article does not establish that ShinyHunters carried out the initial compromise.TeamPCPThe Trivy supply-chain compromise was publicly attributed to TeamPCP; the article reports that the compromised update enabled theft of an AWS API key and access to affiliated accounts.
Vendors
Tools
Trivythe European Commission’s public europa.eu platform was compromised after a supplyâchain attack on the Trivy security tool—attributed to threat actor TeamPCP—allowed attackers to steal an AWS API key and moveTruffleHogOnce inside, the threat actor used scanning tools like TruffleHog to hunt for more credentials while attempting to hide their tracks.