European Commission Data Breach: 300GB Stolen in Trivy Supply Chain Attack

Key Points

• Over 300GB of data stolen from European Commission AWS environment
• Breach linked to TeamPCP group's compromise of Trivy vulnerability scanner on March 19
• Personal data including names, email addresses, and email contents exposed for 71 EU entities
• Same supply chain attack also resulted in theft of Cisco source code

Full Details

The European Commission has confirmed a major data breach linked to the TeamPCP hacking group's compromise of Aqua Security's Trivy vulnerability scanner. Attackers gained access to the Commission's AWS account using an API key that was compromised on March 19 when the Commission inadvertently downloaded a tainted version of the Trivy tool. The breach resulted in the theft of approximately 300GB of data, including personal information such as names, email addresses, and email contents. CERT-EU reported that the exfiltrated data relates to websites hosted for up to 71 clients of the Europa web hosting service: 42 internal clients of the European Commission and at least 29 other Union entities. The same supply chain attack also compromised Cisco, resulting in the theft of portions of the company's source code.