The European Commission's AWS infrastructure was compromised after the institution pulled a poisoned build of Trivy, the open source vulnerability scanner it used to check its own systems for weaknesses. According to reporting on a CERT-EU report published in early April 2026, the intrusion began on 19 March 2026, when attackers harvested a secret AWS API key from the trojanised scanner and pivoted into cloud infrastructure behind the Commission's Europa.eu platform. CERT-EU attributed the intrusion to the cybercrime group TeamPCP; the stolen data was subsequently published online by ShinyHunters, the extortion crew previously tied to Ticketmaster, AT&T and dozens of other victims. Volume figures differ sharply by source: CERT-EU is reported to have cited roughly 92 GB of compressed data (TechCrunch via justpaste.in, The Next Web), while Michael Hollister's analysis describes approximately 340 GB appearing on the dark web nine days after the intrusion. A separate and later incident, reported by BleepingComputer on 8 August 2026 and summarised by ETTAYEB, involves a claim of over 350 GB from a Commission AWS account. Readers should treat the two events as distinct until the Commission says otherwise.
Note on sourcing: no source in this set is the Commission's own statement. All CERT-EU material below is secondhand reporting of that agency's report, and one source (Hollister) notes the Commission communicated about the breach in a manner it "would scarcely have accepted" from a regulated company.
What Happened
The chain reconstructs as follows. In late February 2026, TeamPCP breached the GitHub repository of Trivy, the open source scanner maintained by Aqua Security. The Next Web reports that credential rotation after that first breach was incomplete, leaving the group residual access, which it used to force-push malicious code to 76 of 77 version tags in the trivy-action repository. That is a near-total poisoning of the tagged release surface, meaning version pinning offered almost no protection.
On 19 March, the Commission's automated security pipeline pulled the compromised version. The malware harvested an AWS API key, and that key opened the cloud infrastructure hosting Europa.eu, the platform member states use to publish websites and materials for EU institutions and agencies. CERT-EU is reported as saying at least 29 other EU entities may be affected, with dozens of internal Commission "clients" potentially having data stolen. The Next Web puts that figure differently, describing emails and personal details from "up to 71 clients across EU institutions." Accounts differ on the blast radius, and neither number has been independently confirmed here.
The dual attribution is the unusual part. CERT-EU named one group for the intrusion and another for the leak. A ShinyHunters member told TechCrunch in an online chat that they had taken some of the data TeamPCP had stolen in earlier attacks and then leaked it. TeamPCP could not be reached for comment.
The August incident is a separate matter. ETTAYEB, citing BleepingComputer, reports an unidentified actor claiming over 350 GB including multiple databases and an internal email server, with screenshots showing employee information. AWS stated its services "operated as designed" and that no security event affected its infrastructure. That actor reportedly said they were not seeking extortion but planned to leak later. Hollister frames the pair as two confirmed breaches within two months.
What Was Taken
The data set published online is described as personal data containing names, email addresses and the contents of emails. CERT-EU reportedly found close to 52,000 files containing sent email messages. The agency's own caveat matters: the majority of those emails are automated with little or no content, but bounced messages "may contain the original user-submitted content, posing a risk of personal data exposure." That is the real exposure surface in an otherwise noisy corpus.
Hollister's account adds cryptographic signing keys to the inventory alongside personal data and internal correspondence. NexusTek reports that attackers compromised emails, internal admin data and "potentially a full SSO user directory," though that claim appears in only one lower confidence source and should be treated as unverified.
On volume, do not let anyone hand you a single clean number. Reported figures for the March event run from roughly 92 GB compressed (CERT-EU as reported by TechCrunch and The Next Web) to approximately 340 GB (Hollister). Compressed versus uncompressed accounting plausibly explains part of that gap, but no source reconciles it explicitly. The August claim of 350 GB plus is a different actor and a different intrusion.
Why It Matters
A vulnerability scanner is one of the highest privilege pieces of software in a modern pipeline. It runs automatically, it runs often, and it runs with credentials broad enough to inspect everything it is meant to protect. Poisoning it is not a lateral move, it is a shortcut to the centre. The Commission did not get breached despite running security tooling; it got breached through it.
The regulatory context sharpens the point. Hollister notes that thirteen days before the first attack, the oversight body responsible for EU institutional cybersecurity had described the Union's resilience as solid and on schedule, and that ten days after the intrusion began the Commission proposed a legislative package centred on supply chain security. The institution writing continent-wide binding security rules was, at that moment, running a compromised scanner.
TeamPCP is not a one-incident actor. CyberScoop reports that a self-replicating worm built on the Mini Shai-Hulud repository TeamPCP published in May was used in a separate campaign that compromised a GitHub maintainer account and injected malicious code into more than 440 npm packages in under four hours, eventually reaching more than 860 packages with over two billion combined monthly installs, per Aikido Security's Ilyas Makari. Wiz found compromised packages including keyv, flat-cache and file-entry-cache present in more than 46% of all cloud environments, against roughly 28% for the most prevalent packages in the earlier Shai-Hulud 2.0 campaign. Whether TeamPCP ran that npm campaign directly or simply published the tooling others used, the group's output is now shaping the wider ecosystem's threat surface.
The Attack Technique
The technique is credential theft dressed as a software update, and every stage of it was legitimate infrastructure behaving normally.
Incomplete credential rotation after the February Trivy repository breach is the pivot everything else rests on. The Next Web's account of residual access surviving remediation is the single most actionable detail in this incident: the first breach was contained, the credentials were rotated, and it was not enough. Force-pushing to 76 of 77 version tags then defeated the standard defence of pinning to a known good release, because the known good release was rewritten in place.
From there the malware did what supply chain implants do: harvest secrets from the environment it landed in. One AWS API key was sufficient to reach data across dozens of internal Commission consumers and, per CERT-EU, potentially 29 or more other EU entities. ETTAYEB's read on the August incident points to the same structural weakness from a different angle. AWS's "operated as designed" statement is accurate and beside the point, because the failure sat entirely on the customer side of the shared responsibility model, in identity and access management.
The initial compromise method for the August intrusion has not been disclosed, and no CVE is associated with it.
What Organizations Should Do
- Audit your CI/CD credential blast radius. Assume any secret reachable by an automated pipeline is already exposed and ask what a single harvested cloud API key would unlock. Scope pipeline credentials to the minimum resources and regions they need, with short-lived tokens over static keys.
- Treat rotation as a verification exercise, not a checkbox. The Trivy chain worked because rotation after the first breach was incomplete. After any credential compromise, enumerate every token, deploy key, webhook and CI secret associated with the affected identity, then confirm the old ones actually fail.
- Pin to immutable digests, not tags. Force-pushed tags are rewritable; content-addressed digests are not. Combine with package aging policies, which Wiz explicitly cites as a hardening mechanism that may reduce the npm campaign's final toll.
- Hunt in your security tooling first. Review whether you pulled trivy-action between late February and late March 2026, and check the indicators of compromise published by multiple firms for the Mini Shai-Hulud npm wave. Compromised packages named include keyv, cacheable, flat-cache and file-entry-cache.
- Monitor for anomalous API key use in cloud logs. Both Commission incidents surfaced as valid credentials behaving unusually. Alert on new source ASNs, unusual bulk read operations against S3 or database services, and first-time API calls for a given principal.
- Do not assume automated email archives are low value. Nearly 52,000 files of sent mail were part of this leak, and CERT-EU flags bounced messages as carrying original user-submitted content. Include mail infrastructure in data classification and retention reviews.
Sources: European Commission Hacked: Massive Data Breach by TeamPCP and Shin... | Massive supply-chain attack compromises 440 packages under four hou... | Hackers breached the European Commission by poisoning the security... | The European Commission lost 350 GB of data after its AWS account w... | EU Cyberattack Alert: Inside the 92GB Data Breach & TeamPCP’s Shado... | The Standard That Failed at Home – Michael Hollister | Europe’s cyber agency blames hacking gangs for massive data breach... | The European Commission Trusted Their Cloud Platform. Then Attacker...