InfoSecBulletin Cybersecurity for mankind
The EU’s cybersecurity agency said on Thursday that a recent hack and data leak at the EU was done by a cybercriminal group called TeamPCP.
In a new report, CERT-EU said that hackers exfiltrated about 92 gigabytes of data from an Amazon Web Services (AWS) account linked to the European Commission. This data had personal information like names, email addresses, and email content.
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
The breach hit the cloud system of the Commission’s Europa.eu site. Member states use this site to host websites and publications for the bloc’s institutions and agencies.
CERT-EU said that at least 29 more EU groups might be affected, and many internal European Commission clients could also have data stolen. The stolen data was then posted online by another hacking group, the notorious ShinyHunters.
A ShinyHunters member told TechCrunch in a chat that they exfiltrated some data from TeamPCP, which had stolen it before, and then shared it.
CERT-EU said that the breach started on March 19 when hackers got a secret API key from the European Commission’s AWS account. This happened after a hack on the open-source tool Trivy. The Commission accidentally downloaded a bad version of Trivy after it was breached, which let the hackers steal the API key and access data in the Commission’s AWS account.
While the service said it’s still analyzing the data published online, close to 52,000 files contain sent email messages. CERT-EU said the majority of these emails are automated with little to no content, but emails that bounced back with an error “may contain the original user-submitted content, posing a risk of personal data exposure.”
CERT-EU said it is already in contact with affected organizations.
