The European Commission confirms a cyber attack on its cloud infrastructure and the theft of data on the Europa.eu portal

The European Commission is investigating a data breach caused by a cyberattack that affected its cloud infrastructureconfirming the theft of data from their websites in the portal Europa.eu which, according to the attacker, amounts to 350 GB of stolen data.

Specifically, the cyberattack was detected on last Tuesday March 24 and the necessary actions were taken to contain the malicious activity. This included the implementation of risk mitigation measures to protect services and the data without interrupting availability of websites in Europe.

As explained by the organization in a statement on its website, the first results of the investigation indicate that by attacking the cloud infrastructure of the European Commission, which hosts its web presence with the Europa.eu platform, they have stolen data from European websites that make it up and that act as a gateway to multiple services for users.

In this sense, the Commission has notified this attack to the union entities that could have been affected for the incident and, currently, the cybersecurity incident response team continues to investigate the full scope of the event.

However, it must be taken into account that the perpetrator of the cyber attack assures that he has managed to steal more than 350 GB of dataincluding several databases, as a result of this attack, as shared in statements to Bleeping Computer.

Thus, although the person claimed to be responsible has not specified how he managed to access this data from the European Commission, he has shared screenshots with information belonging to employees of the organization already a email server used by the same employees, as proof of this unauthorized access.

With all this, the cybercriminal has clarified that he has intention to leak stolen data ‘online’ later and that it is not seeking to ask the European Commission for a ransom so that they can recover them.

Although the Commission’s internal systems were not affected by the attack, the organization has assured that will continue to monitor the situation and will take “necessary measures to ensure the security of its internal systems and data.” In addition, it has indicated that it will use the results of this attack to “further improve its cybersecurity capabilities.”

“In the face of persistent cyber and hybrid attacks that affect essential services and democratic institutions, Europe is actively working to improve the EU’s cybersecurity resilience“, the organization concluded, referring to measures such as the Cybersecurity Regulation, the NIS2 Directive and the Cybersolidarity Law.