Europe’s Cyber Agency Blames Hacking Gangs for Breach
Basically, hackers stole and leaked sensitive data from the European Commission.
A massive data breach at the European Commission has exposed sensitive information. Hacking groups TeamPCP and ShinyHunters are behind the attack. This incident raises serious security concerns for EU entities.
What Happened
The European Union’s cybersecurity agency, CERT-EU, has reported a significant data breach involving the European Commission. The breach was attributed to a cybercriminal group known as TeamPCP, which exploited a compromised Amazon Web Services (AWS) account. Approximately 92 gigabytes of data were stolen, including personal information such as names and email addresses.
Who's Affected
The breach has impacted not only the European Commission but also potentially 29 other EU entities. This wide-reaching effect underscores the vulnerability of governmental bodies to cyberattacks. The stolen data was subsequently leaked online by another hacking group, ShinyHunters, highlighting a troubling trend of collaboration among cybercriminals.
What Data Was Exposed
The compromised data includes sensitive information stored in the Commission’s Europa.eu platform. Among the 52,000 files accessed, many contain sent email messages. While most of these emails are automated and lack significant content, there is a risk that emails with errors may expose original user-submitted content, leading to potential personal data exposure.
What You Should Do
Organizations that may be affected should take immediate steps to assess their security posture. CERT-EU is already in contact with impacted entities to mitigate risks. It's crucial for organizations to review their security protocols, especially regarding the management of API keys and access to sensitive systems.
Technical Details
The breach originated on March 19 when hackers obtained a secret API key linked to the European Commission’s AWS account. This was made possible by the Commission inadvertently downloading a compromised version of the open-source security tool Trivy. The hackers exploited this vulnerability to pivot and access sensitive data stored in the AWS account.
Defensive Measures
To protect against similar attacks, organizations should:
- Regularly audit and rotate API keys.
- Implement multi-factor authentication for sensitive accounts.
- Monitor for unusual access patterns to cloud services.
- Educate employees about the risks of downloading compromised software.
This incident serves as a stark reminder of the evolving tactics used by cybercriminals and the importance of robust cybersecurity measures.