Ninety-two gigabytes of compressed data. At least 29 other EU entities may be affected. And for once, a government cybersecurity agency skipped the cautious hedging and named names.

CERT-EU, the European Union’s cybersecurity arm, said Thursday that the cybercriminal group TeamPCP was responsible for hacking the European Commission’s cloud infrastructure, and that the notorious ShinyHunters gang then posted the stolen data online. The breach, which came to light in recent weeks, is among the largest ever suffered by an EU institution.

The specificity of the attribution is itself notable. Government cyber agencies — especially those speaking publicly — tend to couch blame in careful language about “advanced persistent threats” or “threat actors.” CERT-EU named two groups directly and described the mechanics of the attack in unusual detail.

How the breach unfolded

According to CERT-EU’s report, the intrusion began on March 19, when hackers obtained a secret API key linked to the European Commission’s Amazon Web Services account. The key came from a compromised version of Trivy, an open-source security scanning tool. The Commission had inadvertently downloaded the tainted copy after Trivy’s own project was breached.

Once inside, the hackers pivoted to the Commission’s AWS environment and exfiltrated roughly 92 GB of compressed data. The stolen files included names, email addresses, and the contents of emails hosted on the Commission’s Europa.eu platform — the infrastructure EU member states use to host institutional websites and publications.

Close to 52,000 of the stolen files contain sent email messages, CERT-EU said. Most were automated messages with minimal content, but bounced-back emails with error notices “may contain the original user-submitted content, posing a risk of personal data exposure.”

The data of at least 29 other EU entities may also be affected, along with dozens of internal Commission clients. CERT-EU said it is already in contact with affected organizations.

Two gangs, one breach

The dual attribution tells a story about how cybercrime now operates as a layered economy rather than a solo pursuit.

TeamPCP carried out the intrusion. According to Aqua Security, the company that develops Trivy, the group has been linked to ransomware attacks and cryptocurrency-mining campaigns. Palo Alto Networks’ Unit 42 has tracked TeamPCP running a systematic campaign of supply chain attacks against open-source security projects — targeting developers who hold keys to sensitive systems, then using that access to extort the organizations those developers serve.

ShinyHunters, a separate and well-known group, handled the leak. A member of ShinyHunters told TechCrunch in an online chat that they obtained some of the data TeamPCP had previously stolen and then published it. The relationship between the two groups — whether transactional, competitive, or merely opportunistic — was not detailed in CERT-EU’s report.

This is the cybercrime-as-a-service ecosystem in action: one group breaches, another monetizes or publicizes, and the victims are left sorting through the wreckage.

Questions the Commission hasn’t answered

The European Commission has not yet publicly addressed the breach in detail. A spokesperson told TechCrunch that the body was closed until next week and would respond to requests for comment then.

The underlying vulnerability — a poisoned open-source tool that compromised a cloud API key — illustrates the fragility of software supply chains. The Commission did not misconfigure its AWS account or fall for a phishing email. It downloaded a legitimate security tool that had been tampered with upstream. That’s a difficult attack to defend against, and it’s the same class of vulnerability that has cropped up in incidents from SolarWinds to the PHP backdoor attempt.

CERT-EU’s decision to name the groups publicly, describe the attack chain, and quantify the damage in specific terms suggests an agency that wants the broader community to learn from this incident — and perhaps a signal that quiet, generic advisories are no longer enough when the threat is this organized.

Sources