EU Cyber Agency Attributes Major Data Breach to TeamPCP
Basically, hackers stole a lot of sensitive data from the European Commission's cloud account.
A major data breach at the European Commission has been linked to the TeamPCP hacking group. Sensitive data from various EU entities has been exposed, raising serious privacy concerns. Cybersecurity officials are investigating the incident and urging better security practices.
What Happened
The European Union’s cybersecurity agency, CERT-EU, has identified the TeamPCP hacking group as responsible for a significant data breach affecting the European Commission. This breach occurred on March 19, when hackers infiltrated the Commission’s Amazon Web Services (AWS) account, extracting approximately 92 gigabytes of compressed data.
Who's Affected
The breach has impacted 42 internal clients and at least 29 EU entities. The stolen data includes names, email addresses, and some email content, raising concerns about potential exposure of personal information.
What Data Was Exposed
CERT-EU reported that the compromised dataset contained nearly 52,000 files related to outbound email communications, totaling 2.2 gigabytes. Although many of these messages were automated with minimal content, some bounce-back notifications could risk exposing personal data.
How the Breach Occurred
The hackers exploited a secret Amazon API key, which allowed them to gain unauthorized access to the Commission’s AWS account. CERT-EU believes that the initial access was achieved through a Trivy supply chain compromise, attributed to TeamPCP. This compromise occurred while the Commission was unknowingly using a compromised version of Trivy from normal software updates.
What You Should Do
Organizations using AWS should review their API key management practices and ensure that they are not vulnerable to similar exploits. Regular audits of software updates and monitoring for unusual network traffic can help detect potential breaches early.
Current Status
The breach was discovered on March 24 after the Commission received alerts about potential misuse of Amazon APIs and abnormal network traffic. By March 28, the stolen data appeared on the ShinyHunters dark web site, indicating that cybercriminal organizations are collaborating to monetize these hacks. CERT-EU is currently investigating the situation and monitoring for any lateral movement within the compromised AWS accounts, though no such movement has been detected so far.
Conclusion
This incident highlights the ongoing threat posed by sophisticated hacking groups like TeamPCP. The collaboration among cybercriminals and the exploitation of software vulnerabilities underscore the need for heightened cybersecurity measures across all sectors, especially within government agencies.