INSIGHTS
European Commission, data on 30 EU bodies: the open source tool that opens the cloud
On 2 April 2026 CERT-EU attributed to TeamPCP the theft of data from the European Commission's cloud, entered with a key stolen through a compromised version of the open source tool Trivy: at least 30 EU bodies involved. The analysis: the security tool as the way in, shared infrastructure and questions for renewals.
Archive: reconstruction written in November 2026
Topic of the month, April 2026 · by cybercoverinsurance
On 2 April 2026 CERT-EU, the incident response team for the EU institutions, attributed to the group TeamPCP the theft of about 90 GB of compressed data from the European Commission's cloud infrastructure that hosts the Europa.eu websites. The access key had been stolen through a compromised version of Trivy, an open source security tool the Commission had downloaded. The data, concerning the Commission and at least 29 other EU bodies, was published by the group ShinyHunters.
For cyber underwriters the case shows how the open source software supply chain brings an attack inside well-protected organisations. The compromised tool was a security control, and the stolen key gave access to an infrastructure shared by dozens of bodies.
What is known
The way in. According to CERT-EU, the Commission inadvertently downloaded a compromised copy of Trivy, an open source vulnerability scanner. The copy let the attackers steal an API key linked to a Commission Amazon Web Services account and enter the account on 19 March. The group TeamPCP, according to Palo Alto Networks' Unit 42, has for months run a systematic campaign against open source security projects (TechCrunch).
What they did. With the key, which had management rights over other accounts, the attackers searched for more secrets with an automated tool, attached a new key to an existing user to avoid detection and exfiltrated data. The Commission publicly confirmed the attack on 27 March. On 28 March ShinyHunters published a 90 GB archive, about 340 GB uncompressed, with names, email addresses, usernames and email content. According to CERT-EU, no website was taken offline or altered and there was no movement to other Commission accounts (BleepingComputer).
The bodies involved. The infrastructure hit hosts the websites of EU institutions and agencies. Dozens of internal Commission clients and at least 29 other EU bodies are potentially involved. About 52,000 files contain sent emails: according to CERT-EU they are mostly automated messages, but those that bounced back with an error may contain data entered by users (TechCrunch).
Two groups. CERT-EU attributed the intrusion to TeamPCP and the publication to ShinyHunters. A ShinyHunters member told TechCrunch the group had taken some of the data TeamPCP had stolen in earlier attacks (TechCrunch).
What is not known. The number of people whose data was exposed, the cost to the Commission and the other bodies and the full list of bodies involved have not been made public. Dates of the first intrusion differ between sources.
The security tool as the way in
The control that opens the door. Trivy is used to find vulnerabilities in software. A compromised version of it gave the attackers the cloud keys. It is the same pattern seen with tj-actions in 2025: the tool used in the development pipeline has access to the most sensitive secrets.
Cloud keys are worth more than data. The stolen key had management rights over other accounts (BleepingComputer). For underwriters, the question is not only whether the insured uses open source software, but what privileges the credentials that software can reach carry.
A campaign, not an incident. TeamPCP hit several open source projects in sequence (TechCrunch). Insureds using the same tools are exposed to the same campaign, even if none of them is the chosen target.
Shared infrastructure
One account, dozens of bodies. The infrastructure hit hosts the websites of many institutions and agencies (TechCrunch). As with the London councils in November 2025, a shared service ties several bodies to the same incident. The number of insureds does not say how many distinct infrastructures there are.
The loss is notification, not interruption. No website was taken down (BleepingComputer). The cost to the bodies involved is mainly data analysis, notification to authorities and individuals, and handling requests. For a portfolio of public bodies or customers of a shared cloud provider, it is a claim of widespread liability.
Two groups, two risks. Those who steal and those who publish are not the same (TechCrunch). Data stolen by one group can end up with another, which uses it for extortion or publishes it. An agreement with the first, if there were one, would guarantee nothing about the second.
What to bring to renewals
Impact for insurersMedium
A compromised version of an open source security tool gave access to the European Commission's cloud, with the theft and publication of data relating to dozens of EU bodies.
On the portfolio side, the case suggests treating campaigns against open source development and security tools as an aggregation event: a single compromised tool can reach many insureds in the same period, with credential thefts that surface weeks later.