European Commission Confirms Cloud Breach — Trivy Supply Chain Attack Cascades Into 30+ EU Entities

Sat, 04 Apr 2026 06:09:10 -0400

What Happened

The European Commission has confirmed a significant data breach originating from the TeamPCP supply chain attack we covered earlier this week. CERT-EU published findings on April 3 attributing the intrusion to TeamPCP for the initial access and ShinyHunters for the subsequent data exfiltration and public leak.

The bottom line: the Commission’s CI/CD infrastructure downloaded a poisoned copy of the Trivy vulnerability scanner after the March 19 compromise. That gave TeamPCP an AWS API key, which they used to pivot into the Commission’s cloud accounts and extract approximately 92 GB of compressed data. ShinyHunters then published the dump online after extortion demands went unanswered.

Aws on cybercrime.club

European Commission Confirms Cloud Breach — Trivy Supply Chain Attack Cascades Into 30+ EU Entities

What Happened