The EU Commission was compromised by the threat actor ShinyHunters through a mas...

Verdict details

Confidence: 90%

Evidence quality: PUTERNICĂ

**What was analyzed:** A social media post claiming that a massive cyber attack occurred against the EU Commission, ENISA, and DG for Digital Services, carried out by the threat actor ShinyHunters, with a detailed list of compromised data. **What sources confirm:** Multiple recent external sources (March 2026) confirm that the European Commission was the target of a cyber attack by ShinyHunters, which affected its cloud infrastructure (the AWS account and the Europa.eu platform) and led to the leakage of over 350 GB of data, including mail servers, databases, confidential documents, and contracts. The Commission confirmed the incident but stated that its internal systems were not affected. **Limitations:** The sources do not explicitly confirm the direct compromise of ENISA and DG for Digital Services as separate entities, but refer to the cloud infrastructure of the Commission. Additionally, some specific types of data mentioned in the post (e.g., complete SSO user directory, DKIM sig…

Sources consulted

• The European Commission suffered a data breach by ShinyHunters ... (threads.com)
• ShinyHunters claims the hack of the European Commission (securityaffairs.com)
• ShinyHunters Claims 350GB Data Breach at European Commission (hackread.com)
• The European Commission suffered a data breach by ShinyHunters ... (x.com)
• European Commission confirms cyberattack after hackers claim data ... (techcrunch.com)
• <secnewsbot> [security-affairs] ShinyHunters claims the hack of the ... (facebook.com)
• The European Commission confirmed a cyberattack affecting part of ... (securityaffairs.com)
• EU Commission web platform hit by cyber-attack on March 24 (reuters.com)

Recommended next steps

• Căutați comunicate oficiale de la Comisia Europeană sau de la ENISA/DG pentru Servicii Digitale pentru detalii suplimentare.
• Monitorizați știrile de la surse de securitate cibernetică de încredere pentru actualizări privind investigația și analiza datelor scurse.

Analysis limitations

• Nu există o listă oficială detaliată a tuturor tipurilor specifice de date compromise, dincolo de categorii generale precum baze de date și servere de mail.
• Comisia Europeană a declarat că sistemele sale interne nu au fost afectate, ceea ce contrazice implicarea directă a unor entități interne precum ENISA și DG pentru Servicii Digitale în compromiterea inițială.
• Un comunicat oficial din partea Comisiei Europene, ENISA sau DG pentru Servicii Digitale care să confirme explicit compromiterea directă a acestor entități.
• O listă verificabilă a datelor exfiltrate, care să includă explicit toate tipurile menționate în postare.

Manipulation techniques detected

• Limbaj Emoțional
• Generalizare Nejustificată
• Zvon / Dezinformare