Brussels cloud hit: eu admits 350 gb stolen, attacker taunts 'no ransom'
The European Commission woke up Tuesday to a blunt message on a hacker forum: 350 GB of your web data is already gone, and I’m not even asking for money. By Wednesday morning, Commission cybersecurity teams had confirmed the breach, locked down the Europa.eu cloud stack that powers everything from tender portals to press rooms, and started the humiliating job of warning 27 governments that citizen-facing sites are now collateral damage.
The anatomy of a cloud heist
Attackers slipped past the outer perimeter of Amazon Web Services-hosted infrastructure that Brussels rents for public-facing websites, not the classified Coreu networks. Once inside, they vacuumed SQL dumps, employee mail spools and what appear to be authentication logs. Screenshots shared with BleepingComputer show internal staff addresses, hashed passwords and a mail-server banner that should never see daylight outside the Berlaymont bunker.
Lo que nadie cuenta es que the Commission’s internal systems—where the real legislative drafts live—were untouched. The cloud silo that got mugged is essentially the EU’s shop window, not its vault. Still, the reputational blast radius is continental: every citizen who ever reset a password on an EU site now has to assume it is floating in a Telegram channel.
No ransom, just chaos
Curiously, the threat actor labels the operation “#OpNoRansom.” Translation: they will dump the data for sport, not profit. That flips the classic extortion playbook and leaves Brussels with zero leverage. No bitcoin clock ticking, just the slow-motion horror of watching 350 GB trickle onto torrent trackers.
The Commission’s incident-response crew, CERT-EU, has pulled the affected repositories offline and is scanning for backdoors planted between 24 March and the weekend. Meanwhile, unions representing Commission staff have received breach notifications; sources inside the institutions say at least 15,000 employee credentials are in the sample set already circulating.
From gdpr cop to gdpr victim
Irony stings. The same executive that fines Meta and TikTok billions for sloppy data stewardship must now report itself to national regulators within 72 hours. Under the GDPR, the Commission could—in theory—fine itself up to €20 million, but expect a bureaucratic shrug: the regulator and the regulated share the same letterhead.
More painful will be the questions from MEPs about why a €180 billion annual budget still outsources critical web infrastructure to the cheapest AWS tier. The attacker’s methodology remains unpublished, yet veterans inside CERT-EU mutter about a long-ignored SSRF flaw in a legacy content-management connector. Translation: a patch delayed since 2022 may have handed the keys to the city.
Brussels insists this is “an isolated incident” and vows to fold the forensics into its upcoming Cyber Solidarity Act. But the calendar betrays them: EU elections are ten weeks away, and every campaign team now has fresh evidence that the bloc cannot guard its own front door. The data will leak, the headlines will fade, yet the aftertaste lingers—Europe wrote the rules of the digital age, then left its own stage door unlatched.