European Commission confirms cyberattack on cloud infrastructure

The European Commission, which serves as the executive branch of the European Union, confirmed on Friday that it has experienced a cyber-attack. The incident affected the cloud infrastructure hosting the Commission’s web presence on the Europa.eu platform, which is the official website platform of the European Union and hosts much of the Commission’s website data. The confirmation came after hackers reportedly stole data from the Commission’s cloud storage.

European Commission spokesperson Thomas Regnier told TechCrunch on Friday that the Commission discovered a cyber-attack that affected part of its cloud infrastructure. Regnier clarified that the Commission’s internal systems were not affected by the cyber-attack. In a statement, Regnier added: “We have taken immediate steps and contained the attack. Risk mitigation measures were also implemented. The investigation is ongoing but we can already confirm that the Commission’s internal systems were not affected by the cyber-attack”

The data breach was first reported on Friday by Bleeping Computer, a publication specializing in cybersecurity, which cited sources with knowledge of the incident. According to Bleeping Computer, hackers stole hundreds of gigabytes of data, including multiple databases, from the European Commission’s account on Amazon Web Services, the cloud provider hosting the affected infrastructure. The hackers reportedly provided the publication with evidence of their unauthorized access, including screenshots.

While the European Commission has confirmed the cyber-attack on its Europa.eu web hosting infrastructure, it is not immediately clear what specific kinds of data were stolen during the breach. The Commission has initiated an ongoing investigation to determine the full scope of the incident and has implemented risk mitigation measures to secure the affected cloud environment. The investigation is ongoing, but the Commission has already confirmed that its internal systems remain unaffected.

Why it matters

This incident highlights the ongoing security challenges for public sector entities relying on third-party cloud infrastructure, even when core internal systems are successfully isolated from the breach.