The EU's Security Scanner Became the Attack

A compromised Trivy update stole an AWS master key. 340GB exfiltrated. 71 EU institutions hit. The body that enforces GDPR couldn't protect its own data.

State of Surveillance Editorial Team

European Union flags on poles against a blue sky outside an institutional building
Photo via Unsplash

TL;DR: CERT-EU's April 3 analysis confirms how the European Commission got breached: attackers from TeamPCP compromised Aqua Security's Trivy vulnerability scanner (the very tool organizations use to find security flaws) and pushed a malicious update. The Commission downloaded it through normal update channels on March 19. The poisoned Trivy stole an AWS API key that functioned as a master key across the Commission's cloud infrastructure. TruffleHog was used for reconnaissance. ShinyHunters published 340GB (91.7GB compressed) of stolen data from up to 71 EU entities, including personal data, contracts, emails, and military financing documents. Five days passed before anyone noticed.

How a Security Tool Became a Weapon

Trivy is one of the most popular open-source vulnerability scanners in the world. Organizations run it to find security flaws in their code and infrastructure. The European Commission ran it too.

On March 19, 2026, at 17:43 UTC, the cybercrime group TeamPCP (also tracked as DeadCatx3 and ShellForce) compromised Trivy's release infrastructure and force-pushed a malicious version, v0.69.4, using a hijacked aqua-bot service account. They didn't just hit the core binary. They compromised 75 of 76 version tags for the trivy-action GitHub Action and all 7 tags for setup-trivy.[1]

Anyone running Trivy in their CI/CD pipeline that day pulled the poisoned update automatically. The European Commission was one of them.

This wasn't TeamPCP's first hit. They'd spent the previous six weeks systematically attacking the tools organizations use to defend themselves, including KICS, LiteLLM, Telnyx, and Checkmarx GitHub Actions, plus 47+ npm packages via a campaign called "CanisterWorm."[2]

The Two-Phase Attack

Phase 1 (February 27-28): An AI-powered autonomous bot called hackerbot-claw exploited a misconfigured pull_request_target workflow in Trivy's GitHub Actions. It stole a privileged Personal Access Token by making imposter commits that spoofed legitimate maintainers. Aqua Security attempted containment, but the credential rotation was incomplete.[3]

Phase 2 (March 19): The credentials that survived Aqua's incomplete rotation gave TeamPCP residual access to Trivy's release infrastructure. At 17:43 UTC, they force-pushed the malicious tag. The poisoned binary contained a three-stage credential stealer self-described internally as the "TeamPCP Cloud stealer."[1]

What that stealer did was thorough:

  • Stage 1, Collection: Read process memory, searched for secrets patterns, and swept 50+ filesystem paths for SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, Docker credentials, database passwords, TLS keys, and cryptocurrency wallets
  • Stage 2, Encryption: Packaged everything using AES-256-CBC with RSA-4096 hybrid encryption into a file called tpcp.tar.gz
  • Stage 3, Exfiltration: Sent data to a typosquatted domain (scan.aquasecurtiy[.]org), note the misspelling of "security." Backup method: create a tpcp-docs repository in victim GitHub accounts with stolen data as release assets

The poisoned Trivy was live for roughly four hours (18:22 to 21:42 UTC for the binary). In that window, one of the secrets it harvested was an AWS API key from the European Commission's CI/CD pipeline.[2]

One Key to Rule Them All

The stolen AWS key wasn't just any credential. SecurityOnline reported it functioned as a "master key, granting control over other AWS accounts affiliated with the European Commission."[4]

With the key, the attackers:

  1. Deployed TruffleHog (a secret scanning tool) to validate credentials via AWS Security Token Service (STS) calls
  2. Scanned the Commission's AWS environment for additional secrets
  3. Created and attached a new access key to an existing IAM user for persistence
  4. Began reconnaissance across the infrastructure

CERT-EU stated: "The threat actor used the compromised AWS secret to create and attach a new access key to an existing user, aiming to evade detection."[5]

The Commission's Security Operations Centre didn't detect anything until March 24, five days after the initial compromise. CERT-EU was formally notified on March 25.[5]

71 Institutions. 340 Gigabytes.

The breach affected the Europa.eu web hosting platform, which serves 71 clients: 42 internal European Commission departments and at least 29 other EU entities.[5]

On March 28, ShinyHunters, the notorious group behind breaches at Ticketmaster, AT&T, and 60+ other companies, published 91.7GB compressed (approximately 340GB uncompressed) on their dark web leak site.[6]

What was in the dump:

  • Personal data: names, usernames, email addresses from users across multiple EU entities
  • 51,992 outbound email files totaling 2.22GB
  • Multiple databases
  • Confidential documents and contracts
  • DKIM signing keys (which could be used to forge emails appearing to come from EU institutions)
  • NextCloud content collaboration platform data
  • Athena military financing mechanism data
  • Single sign-on (SSO) user directory
  • Internal admin URLs

The Athena data stands out. Athena is the EU mechanism for common financing of military operations and missions. Its data appearing in a criminal leak raises questions far beyond typical personal data exposure.

The GDPR Enforcer Can't Follow Its Own Rules

The European Commission wrote GDPR. It enforces GDPR. It has fined companies hundreds of millions of euros for failing to protect personal data.

On January 20, 2026, just ten days before an earlier Ivanti EPMM breach hit Commission staff mobile devices, the Commission held a press conference to announce its new Cybersecurity Package, emphasizing supply chain protections and enhanced incident response. The Commission positioned itself as the authority on exactly the kind of attack it was about to suffer.[7]

Under the rules it wrote, the Commission must:

  • Notify the European Data Protection Supervisor within 72 hours
  • Demonstrate "appropriate technical and organisational measures" were in place
  • Inform affected individuals "without unnecessary delay" if the breach poses high risk

Commission spokesperson Thomas Regnier said: "We have taken immediate steps and contained the attack." The Commission told press it had "discovered a cyber-attack, which affected part of our cloud infrastructure."[8]

The Register noted the response was "notably sparse for an institution that often emphasizes breach transparency." The Commission did not respond to journalist inquiries about specific data types, volume, or duration of attacker access.[7]

As one security researcher put it: "Writing the rules and following them are different competencies."

The Supply Chain Problem Nobody's Solving

This breach is a textbook supply chain attack: the kind that security professionals have warned about for years and that organizations are still catastrophically unprepared for.

The European Commission did nothing wrong in using Trivy. It's a respected, widely-deployed tool maintained by Aqua Security. But the Commission (and thousands of other organizations) trusted mutable version tags in their CI/CD pipelines instead of pinning to immutable SHA hashes. When the tag was force-pushed, every automated pipeline pulled the malicious version.

CERT-EU's key recommendations[5]:

  • Pin all CI/CD dependencies to full SHA hashes, not mutable tags
  • Rotate all cloud credentials immediately
  • Deploy real-time monitoring for anomalous API activity
  • Audit Trivy versions across all pipelines
  • Enforce least-privilege IAM policies
  • Implement vendor risk management for open-source tools

The SHA pinning advice is critical. If your pipeline pulls trivy:v0.69.4 by tag, an attacker who compromises the tag compromises you. If you pin to trivy@sha256:abc123..., a force-pushed tag changes nothing. The difference between "we got breached" and "the attack bounced off" was a configuration change that takes five minutes.

Timeline

  • Feb 27-28: Phase 1: hackerbot-claw steals PAT via misconfigured GitHub Actions; Aqua Security attempts incomplete credential rotation
  • Mar 19, 17:43 UTC: Phase 2: TeamPCP force-pushes malicious Trivy v0.69.4; EC downloads poisoned update; AWS key stolen
  • Mar 19: Attacker deploys TruffleHog, creates new IAM access keys for persistence
  • Mar 24: EC Security Operations Centre detects anomalous API activity, 5 days after compromise
  • Mar 25: CERT-EU formally notified; compromised credentials disabled
  • Mar 27: European Commission publicly discloses the incident
  • Mar 28: ShinyHunters publishes 91.7GB compressed dataset on dark web
  • Mar 31: Direct communications to affected entities begin
  • Apr 3: CERT-EU publishes formal analysis attributing the breach to the Trivy supply chain compromise

What to Watch

  • EDPS investigation: The European Data Protection Supervisor must investigate the Commission's compliance with its own breach notification obligations
  • TeamPCP next targets: This group is systematically hitting security tools. KICS, LiteLLM, Checkmarx, and now Trivy. Whatever tool they compromise next gets weaponized against every organization that runs it
  • ShinyHunters data use: 340GB of EU institutional data is now on the dark web. The DKIM keys alone could enable sophisticated phishing campaigns impersonating EU institutions
  • Open-source supply chain governance: The EU's own Cyber Resilience Act (CRA), which takes effect in 2027, is supposed to address exactly this kind of supply chain risk. The Commission just became its own case study

References

  1. Wiz: Trivy Compromised: TeamPCP Supply Chain Attack Technical Analysis
  2. Help Net Security: Trivy Supply Chain Attack Enabled European Commission Cloud Breach (April 3, 2026)
  3. Palo Alto Networks: Trivy Supply Chain Attack: hackerbot-claw and Attack Phases
  4. SecurityOnline: The EU's AWS "Master Key": European Commission Trivy Supply Chain Attack
  5. CERT-EU: Official Advisory: European Commission Cloud Breach via Trivy Supply Chain (April 3, 2026)
  6. BleepingComputer: CERT-EU: European Commission Hack Exposes Data of 30+ EU Entities
  7. The Register: European Commission Breach: Sparse Response From Transparency Champions
  8. TechCrunch: Europe's Cyber Agency Blames Hacking Gangs for Massive Data Breach (April 3, 2026)