CERT-EU links Commission cloud breach to Trivy compromise

CERT-EU said on 2 April that it assessed with high confidence that a Trivy supply-chain compromise enabled the breach of the European Commission’s Europa website infrastructure. The incident analysis traced initial access to an AWS credential acquired on 19 March through a compromised version of the security scanner.

The Commission detected suspicious activity on 24 March and publicly disclosed the incident on 27 March. CERT-EU reported about 91.7 GB of compressed data had been taken, including names, email addresses and email content. It said data concerning at least 29 other Union entities might be affected.

Compromised access keys were disabled or deleted. CERT-EU found no indication of movement into other Commission AWS accounts, although the stolen credential could have enabled it. It also reported no website tampering or service interruptions.

The assessment connected the intrusion to compromised software updates. It did not establish an AWS platform vulnerability, and analysis of affected databases was still underway when published.