European Commission confirms cyberattack after breach of AWS-hosted web environment

The European Commission has confirmed a cyberattack that hit part of its cloud infrastructure hosting the Commission’s web presence on the Europa.eu platform. The incident was discovered on March 24, 2026, and the Commission said it affected an external cloud environment rather than its internal systems.

The Commission also said the affected websites remained available during the response, which means the attackers did not knock the public-facing platform offline. Early findings suggest data was extracted from the compromised web platforms, but officials said the investigation is still ongoing and the full impact has not yet been established.

A key point in the Commission’s statement is that its core internal IT systems were not affected. Officials said the architecture separated the public-facing cloud environment from internal networks, which appears to have limited the breach and blocked lateral movement into more sensitive systems.

What the Commission has confirmed so far

Commission spokesperson Thomas Regnier said the institution “discovered a cyber-attack, which affected part of our cloud infrastructure,” according to TechCrunch and Bloomberg Law. He also said the Commission’s internal systems were not affected, which remains one of the most important details disclosed so far.

Reuters reported that the compromised environment hosted the Commission’s public web presence on the Europa.eu platform. The Commission said it moved quickly to contain the incident and apply mitigation measures, and that it is notifying specific Union entities that may have been affected by the exposed data.

AWS also pushed back on any suggestion that its own cloud platform was breached. In comments reported by BleepingComputer, AWS said it “did not experience a security event” and that its services operated as designed, indicating the incident stemmed from the Commission’s compromised account or environment rather than a hack of AWS itself.

Why this breach matters

This attack stands out because it hit a major public institution’s cloud-hosted web environment without disrupting public access. That suggests the attackers may have focused more on access and data collection than on sabotage. This is an inference based on the Commission’s statement that websites stayed online while data may have been taken.

The case also shows why segmentation still matters. The Commission said the separation between its external web infrastructure and internal administrative systems helped prevent the incident from becoming much worse. In practical terms, that design appears to have contained the breach to the cloud-hosted public platform instead of letting attackers pivot deeper into internal networks. This is an inference drawn from the Commission’s own description of the impact.

It comes at a tense moment for Europe as institutions face growing cyber and hybrid threats. The Commission made a similar point in its February response to a separate mobile-device incident, saying the event would feed into broader efforts to strengthen its cybersecurity posture.

Incident snapshot

Source basis: Reuters, Bloomberg Law, TechCrunch, and BleepingComputer.

What officials are doing now

The Commission said it activated incident response procedures as soon as it detected the intrusion. Officials applied containment and mitigation measures, secured remaining services, and began reviewing the technical impact of the breach.

The institution also said it is contacting specific Union entities that may have been affected. That suggests the data involved may relate to organizations connected to the targeted web platforms, though officials have not yet publicly detailed the type or volume of data involved.

For now, there is no confirmed public attribution from the Commission. Some outside reporting has mentioned claims from a threat actor, but the Commission has not publicly confirmed responsibility, so that detail should stay separate from what officials have actually verified.

What organizations can learn from this

The incident underlines a familiar lesson. Public-facing cloud environments need strong identity controls, tight monitoring, and clean separation from internal systems. When that separation holds, it can stop a cloud account compromise from turning into an internal network breach. This is an inference based on the Commission’s description of what was and was not affected.

It also shows that keeping services online during a breach does not mean the impact is minor. In this case, the websites remained available, yet investigators still found signs that data had been taken. That combination is exactly why defenders need to look beyond uptime and review logs, identities, permissions, and storage access after any suspicious cloud event. This is an inference based on the reported facts.

FAQ