The European Commission lost 350 GB of data after its AWS account was hacked — the shared responsibility model failed at the first hurdle

A threat actor compromised a European Commission AWS account in early August 2026 and exfiltrated over 350 GB of data, including databases and an internal email server. The incident is a reminder that the weakest link in cloud security is not the provider's infrastructure — it's client-side identity and access management.