CERT-EU attributed the European Commission cloud breach to TeamPCP, which used a compromised AWS API key stolen in the Trivy supply-chain attack to access the Commission’s Amazon cloud environment and exfiltrate data affecting up to 71 Europa web hosting service clients.
The incident is a clear example of weak token governance turning a CI/CD credential theft event into direct cloud infrastructure compromise. CERT-EU said the Commission’s Cybersecurity Operations Centre was not alerted to API misuse, potential account compromise or abnormal network traffic until March 24, even though the initial intrusion began on March 10. TeamPCP then used TruffleHog to discover additional secrets and attached a newly created access key to an existing user to evade detection and maintain access. CERT-EU confirmed theft of tens of thousands of files containing personal data and email-related content, with exposure spanning 42 internal Commission clients and at least 29 other Union entities. The operational lesson is clear: cloud tokens and identity must be tightly constrained, continuously inventoried and automatically monitored for misuse, because a single exposed build credential can quickly expand into persistent multi-account compromise and regulated data loss.
| What Happened | Cause | Action |
|---|---|---|
| A CI/CD-stolen AWS key was valid for real cloud administration | CERT-EU said TeamPCP used a compromised AWS API key with management rights over other European Commission AWS accounts and the key had been stolen in the Trivy supply-chain attack. This indicates the credential was not sufficiently isolated from production-like cloud control planes. | Validate whether any CI/CD, build or scanning environments hold long-lived cloud credentials with management rights, cross-account access or broad IAM permissions. SkySiege assesses and surfaces that cross account identity mapping so it’s clear what identities have access to what resources. |
| Token scope enabled expansion from one credential to broader compromise | After initial access, TeamPCP used TruffleHog to search for additional secrets, showing that secret sprawl inside the environment allowed the attackers to deepen access. | Validate where secrets are stored in compute instances, repositories, environment variables, user data and application configuration. Visibility is key for getting a handle on the identities at play and the restrictions they have on their usage. |
| Attackers established persistence by creating a new access path on an existing identity | CERT-EU said the attackers attached a newly created access key to an existing user to evade detection before further reconnaissance and theft. This reflects inadequate controls on key creation and weak monitoring of identity lifecycle events. | Validate whether IAM users still exist, whether programmatic access keys can be created without approval and whether alerts trigger on key creation, rotation anomalies or dormant identities becoming active. SkySiege detects for all of this however also detects multiple keys being attached to a single IAM user to avoid and detect this sort of compromise. |
| Cloud monitoring did not detect API misuse quickly enough | The Commission reported its Cybersecurity Operations Centre was not alerted to API misuse, potential account compromise or abnormal network traffic until five days after the initial intrusion. | Validate that CloudTrail-equivalent activity, API anomaly detection, GuardDuty-style findings and egress monitoring are enabled and centrally reviewed. SkySiege has a CloudTrail enhancement product that translates raw CloudTrail logging into useful, human readable metrics including Network Intelligence and operational actions. |
| A shared hosting environment increased blast radius across multiple entities | CERT-EU said the exfiltrated data related to websites hosted for 42 internal clients and at least 29 other Union entities using the europa.eu web hosting service. A compromise in a shared cloud environment affected many tenants. | Validate tenant isolation, data separation, account segmentation and whether shared hosting services are bounded by separate accounts, roles and storage controls. SkySiege maps resource connectivity allowing you to see where environments are connected and quantifying that blast radius. |
| Sensitive data was accessible for bulk exfiltration | CERT-EU confirmed theft of tens of thousands of files containing personal information, usernames, email addresses and email content, including bounce-back notifications that may include original user-submitted content. | Validate where regulated or user-submitted data is stored, whether it is encrypted and whether least-privilege access is enforced for storage and messaging systems. |
| The response model was too slow for an attack that unfolded over days | The intrusion began on March 10, was not detected until March 24 and the stolen data was published by March 28. The attacker operated fast, while token misuse controls and response visibility lagged. | Validate whether token monitoring, revocation workflows and incident containment can execute automatically at machine speed. Given the sheer scale of the data at play in cloud environments SkySiege focuses on the real resource state and surfaces only the relevant factors including cost, compromise and efficiency. |
This breach shows how one exposed machine credential can become an enterprise-wide cloud incident when token governance is weak. The key risk was not only the theft of an AWS secret through a supply-chain attack, but that the token retained management rights over real cloud accounts and could be used outside the intended build environment. That is a governance failure as much as a security failure.
The detection gap is equally important. CERT-EU’s timeline shows the Commission was not alerted to API misuse, account compromise or abnormal traffic for days. In practice, that means the organisation lacked timely visibility into high-risk identity events such as unusual API use, secret harvesting and creation of new access keys for persistence. Where monitoring is not automated and continuous, attackers can move faster than responders.
There is also a clear architectural lesson around shared services. The europa.eu hosting environment created concentration risk: one cloud compromise affected 42 internal clients and at least 29 other Union entities. For due diligence, this raises questions about account boundaries, tenant isolation and whether administrative planes are segmented enough to limit blast radius.
Business impact extends beyond technical compromise. CERT-EU confirmed exposure of personal data and email-related content, creating reputational harm, regulatory scrutiny and possible legal exposure tied to data protection obligations. Financially, incidents like this drive forensic cost, notification cost, remediation effort and potential redesign of cloud identity architecture. For enterprise risk teams, the core lesson is clear: static or broadly scoped cloud tokens, especially those reachable from CI/CD systems, should be treated as high-value attack paths requiring automated control, monitoring and rapid revocation.
