On March 24, the European Commission detected what it now calls a “cyberattack” on the cloud infrastructure behind its Europa.eu web platform. Six days later, the extortion group ShinyHunters claimed responsibility and published proof: screenshots, file trees, and an initial 90GB archive from what they say is a 350GB haul of mail servers, databases, confidential documents, and contracts pulled from the Commission’s Amazon Web Services environment.
The Commission’s official response confirmed that data was taken. It also insisted that “internal systems” were not affected and that no Europa websites were disrupted during the incident. This is the institutional equivalent of your house getting robbed and telling the neighbors your lawn looks great.
Look at what ShinyHunters says they have. Not just emails and attachments, but a full SSO user directory, DKIM signing keys, AWS configuration snapshots, NextCloud and Athena data, and internal admin URLs. Each of those items creates a distinct threat vector. The SSO directory is a roadmap of every authenticated user in the system. The AWS config snapshots reveal how the environment was architected, what services connect to what, where the seams are. The internal admin URLs are reconnaissance gold for any follow-on attack.
But the DKIM keys are the real problem. DKIM is the email authentication protocol that lets a receiving server verify a message actually came from the domain it claims to come from. If you possess the signing keys for europa.eu domains, you can forge emails that pass authentication checks. Emails that look legitimate to every spam filter and every inbox. Imagine a spear-phishing campaign targeting EU member state officials, originating from what appears to be a genuine European Commission address. That is not hypothetical anymore. The keys are out.
AWS, for its part, told reporters that it “did not experience a security event” and that its services “operated as designed.” This is technically accurate in the way that saying a highway operated as designed after a car crash is technically accurate. Nobody is blaming the road. The question is what the Commission was doing with its IAM controls, its access policies, and its monitoring. A breach that exfiltrated 350GB of data from an AWS account without triggering immediate detection points to configuration failures, not infrastructure failures.
ShinyHunters is not an unknown quantity. The group first appeared in 2020 and immediately started racking up victims: Tokopedia (91 million accounts), Mathway (25 million users), Microsoft (500GB of source code from a private GitHub repo). Their 2024 Snowflake campaign was a masterclass in exploiting weak credential hygiene. They systematically targeted customer accounts that lacked multi-factor authentication, hitting Ticketmaster (560 million records), AT&T (110 million call and text records), Santander Bank, Advance Auto Parts, and LendingTree across a single coordinated operation. One of their members, French national Sebastien Raoult, was arrested in Morocco in 2022, extradited to the U.S., and sentenced to three years in prison with a $5 million restitution order. The arrest did not slow the group down. It rarely does with decentralized threat actors.
In February 2026, ShinyHunters hit Wynn Resorts. Weeks later, the European Commission. The tempo is accelerating.
And this is the part the Commission would prefer you not focus on: March 24 was not their first incident this year. In late January, CERT-EU detected an intrusion into the Commission’s central Mobile Device Management infrastructure, exposing staff names and mobile phone numbers. That breach was linked to two zero-day vulnerabilities in Ivanti’s Endpoint Manager Mobile software that were simultaneously exploited against the Dutch Data Protection Authority and Finland’s Valtori agency. The Commission disclosed it in February, called it contained, and moved on. One month later, a completely different attack group walked through a completely different door and took 350GB of data on its way out.
Two separate breaches at the same institution in under 60 days. Different attack vectors, different threat actors, different infrastructure layers. This is not bad luck. This is a pattern of systemic inadequacy in security posture at one of the most powerful governing bodies in the world.
The F5 BIG-IP source code theft showed what happens when attackers get the blueprints. The SharePoint CVE that went unpatched for months showed what happens when institutions treat patching as optional. The Trivy supply chain compromise showed how security tooling itself becomes the entry point. Now the European Commission is adding another chapter to the same running story: the organizations telling everyone else to improve their cybersecurity posture cannot secure their own systems.
To be fair: ShinyHunters’ claims remain unverified by independent researchers as of this writing, and threat groups routinely exaggerate the scope and sensitivity of stolen data to increase leverage. The 350GB figure could include significant amounts of publicly available or low-sensitivity material. The Commission’s distinction between “public-facing web infrastructure” and “internal systems” may be meaningful if the AWS environment truly held only web content and ancillary data. And the Ivanti breach in January, while embarrassing in proximity, was a zero-day exploit affecting multiple European government agencies simultaneously, not evidence of uniquely poor security at the Commission.
None of that changes the DKIM problem. The European Commission handles trade policy, regulatory enforcement, and diplomatic communications that affect 450 million people across 27 countries. If those signing keys are in criminal hands, forged emails impersonating Commission officials could target government agencies, businesses, and individuals across Europe. The immediate risk is not the data that was stolen. It is what that data enables next. Every email from an @europa.eu address now deserves an extra second of skepticism.