The European Commission lost 350 GB of data after its AWS account was hacked — the shared responsibility model failed at the first hurdle

On August 8, 2026, BleepingComputer revealed that the European Commission — the EU’s executive body — was investigating an intrusion into its Amazon Web Services environment. A threat actor claimed to have exfiltrated over 350 GB of data, including multiple databases and an internal email server. AWS confirmed that its services had “operated as designed” and that no security event had affected its infrastructure.

That detail — “operated as designed” — is precisely the problem. It points to a failure of the shared responsibility model, and more specifically to the most basic tier of cloud security: identity and access management.

What we know about the intrusion

The facts established by BleepingComputer and sources close to the investigation are as follows:

• At least one AWS account belonging to the European Commission was compromised by an unidentified threat actor.
• The attacker claims to have stolen over 350 GB of data and provided screenshots showing access to Commission employee information and an internal email server.
• The intrusion was quickly detected, and the Commission’s cybersecurity incident response team is investigating.
• The attacker states they are not seeking to extort the Commission but plan to leak the data online at a later date.
• The Commission has not yet publicly communicated about the incident.

The initial compromise method has not been disclosed. No specific CVE is associated with this incident at this stage, which reinforces the hypothesis of an identity-based compromise rather than exploitation of a software vulnerability.

The shared responsibility model did not protect the Commission

AWS’s shared responsibility model has been clear for two decades: AWS secures the infrastructure of the cloud (hardware, hypervisor, physical network); the customer secures what they put in the cloud (data, identities, configurations, encryption). The statement “AWS did not experience a security event” confirms that the breach occurred on the customer side — most likely at the IAM layer.

The most probable vectors, in order:

1. Exposed IAM access keys in a code repository, configuration file, or CI/CD pipeline. In 2025, GitHub detected 39 million secrets exposed in public repositories. A single key with AdministratorAccess or S3FullAccess is enough to drain entire buckets.
2. Compromised IAM user credentials without multi-factor authentication (MFA) — a mistake that remains surprisingly common even in government organizations.
3. Externally assumable IAM role — a misconfigured role with an overly permissive trust policy, combined with a compromised identity federation.
4. Unmonitored programmatic access — a service account used by a third-party application or partner, never audited, never deactivated.

In all these cases, the attack surface is not AWS infrastructure but human and machine identity management on the customer side. The European Commission incident is a reminder that cloud security posture management (CSPM) does not replace basic IAM hygiene: key rotation, least privilege, mandatory MFA, and removal of dormant identities.

350 GB of what?

The size of the exfiltration — 350 GB — gives an indication of the type of data compromised. For comparison:

• 350 GB of office documents represents roughly 7 to 10 million pages of Word or PDF files.
• 350 GB of databases could contain tens of millions of structured records — internal correspondence, partner data, contractual information.
• 350 GB of emails with attachments represents several years of messaging archives for an organization the size of the Commission (32,000 employees).

The mention of an internal email server is particularly concerning. Access to the email system of an institution like the European Commission exposes not only personal data but also diplomatic negotiations, pre-decision exchanges, and commercially sensitive information covered by confidentiality agreements.

Why the Commission’s response matters

The European Commission is subject to Regulation (EU) 2018/1725 — GDPR’s equivalent for EU institutions. This regulation requires 72-hour notification to the European Data Protection Supervisor (EDPS) in the event of a personal data breach. The absence of public communication eight days after detection suggests either that the investigation is still ongoing or that the impact assessment has not been completed.

But silence carries a cost. An institutional actor that does not communicate about a breach documented by the press loses the trust of Member States, business partners, and European citizens whose data is potentially exposed. Transparency is not optional — it is a regulatory and political obligation.

How a CISO can avoid the same scenario

This incident provides an immediately actionable checklist for any organization using AWS:

1. Audit all IAM keys older than 90 days. Deactivate those that have not been used. Delete those without an identified owner.
2. Enforce MFA on all human IAM accounts, without exception. Enable IAM roles for machine workloads rather than static keys.
3. Enable AWS CloudTrail across all accounts and regions with log integrity validation. An intrusion without logs is an intrusion that cannot be investigated.
4. Implement SCPs (Service Control Policies) to block dangerous actions at the AWS organization level: disabling CloudTrail, creating unrestricted IAM keys, making S3 buckets publicly accessible.
5. Monitor suspicious API calls via GuardDuty and IAM Access Analyzer findings — a key used from an unusual geography or a role assumed by an unexpected external principal must trigger an immediate alert.

Verdict

The intrusion into the European Commission’s AWS account is not a sophisticated zero-day exploit. It is the predictable failure of identity management in a large organization that treats the cloud as an outsourced datacenter rather than as a distributed system where every identity is a security perimeter.

If your organization uses AWS and you cannot state with certainty that every IAM key is assigned, auditable, and MFA-protected, you are in the same situation as the European Commission before August 8. The difference is you still have time to fix it.

References

• BleepingComputer — European Commission investigating breach after Amazon cloud account hack (August 8, 2026)
• BleepingComputer — European Commission confirms data breach after Europa.eu hack
• AWS Shared Responsibility Model
• GitHub — Octoverse 2025: State of secrets scanning
• Regulation (EU) 2018/1725 — Data protection for EU institutions