EU Probes Amazon Cloud Hack Data Breach
▼ Summary
– The European Commission is investigating a security breach where a threat actor accessed its Amazon Web Services cloud environment.
– The attacker claims to have stolen over 350 GB of data, including employee information and database contents, and plans to leak it online.
– Amazon Web Services stated its services were not compromised and operated as designed during this incident.
– This follows a separate January breach of the Commission’s mobile device management platform, linked to attacks on other European institutions.
– These incidents precede recent EU actions, including a cybersecurity legislative proposal and sanctions against companies for cyberattacks.
The European Commission is actively investigating a significant data breach within its Amazon Web Services (AWS) cloud environment. This security incident, which has not yet been publicly announced by the EU’s executive body, involved unauthorized access to at least one of the Commission’s AWS accounts. According to sources, the breach was detected rapidly, and the Commission’s cybersecurity response team is now leading the inquiry.
A spokesperson for AWS stated that its platform did not experience a security event and that its services functioned as intended. However, the individual claiming responsibility for the attack contacted media, asserting they had exfiltrated more than 350 GB of data. This haul reportedly includes multiple databases and information related to Commission employees. The threat actor provided screenshots as evidence of access to an internal email server and employee data.
Notably, the attacker indicated they do not plan to use the stolen information for extortion. Instead, they intend to publicly leak the data online at a future date. The method of initial compromise remains unclear.
This event marks the second major security breach disclosed by the European Commission this year. In February, the Commission revealed a separate incident involving its mobile device management platform, discovered on January 30. That earlier breach is believed to be connected to attacks on other European institutions, exploiting vulnerabilities in Ivanti Endpoint Manager Mobile software.
These consecutive incidents occur against a backdrop of heightened EU focus on cybersecurity legislation. In January, the Commission proposed new rules designed to bolster defenses against state-sponsored actors and cybercrime groups targeting critical infrastructure. Furthermore, just last week, the Council of the European Union imposed sanctions on three Chinese and Iranian companies for orchestrating cyberattacks against member states’ essential systems.
(Source: BleepingComputer)
