European Commission web-hosting cloud account breached via Trivy supply-chain attack; 91.7 GB of data published

CERT-EU said the AWS account behind the European Commission's europa.eu web-hosting service was compromised and about 91.7 GB (compressed) of data was exfiltrated, including names, email addresses and email content ^[1]. CERT-EU assessed with high confidence that initial access came from the Trivy supply-chain compromise; the data relates to up to 71 hosting clients, 42 internal Commission clients and at least 29 other Union entities, and ShinyHunters published it on March 28 ^[1]. CERT-EU recommends rotating all AWS secrets and credentials that may have been exposed to Trivy and reviewing CloudTrail for indicators such as anomalous STS calls ^[1].

Industries mainly affected: Government

1. Rotate all AWS secrets and credentials that may have been exposed to Trivy during the compromise window ^[1].
2. Review AWS access keys reachable from CI/CD pipelines and deactivate unused, over-privileged or exposed keys ^[1].