What happened
CERT-EU reported that a European Commission AWS cloud account tied to the europa.eu web platform was compromised after attackers obtained credentials through the earlier Trivy supply-chain attack.
According to CERT-EU, attackers used the compromised access to perform reconnaissance and exfiltrate a large dataset (about 91.7 GB compressed, ~340 GB uncompressed). The exposed data may include records related to dozens of EU entities that use the shared hosting service.
Why this matters
This is a practical example of a “second-order” supply-chain impact: even if your own code was not directly backdoored, credentials exposed in CI/CD tooling can still become a path to cloud-account takeover and data theft.
For organizations using Trivy, GitHub Actions, or similar pipeline tooling, this is not just a headline about Brussels — it is a warning about credential scope, key rotation speed, and cloud monitoring gaps.
How to check if you’re affected
You may be affected if your team ran Trivy versions before the vendor-safe releases (for example, versions before v0.69.2 / affected trivy-action builds) and any CI/CD jobs had access to AWS keys, cloud tokens, or secrets.
- Inventory all Trivy usage across CI/CD (including old workflows, forks, and self-hosted runners).
- Confirm versions/actions were updated to known-safe releases from vendor guidance.
- Rotate all AWS keys/tokens that may have been exposed to affected pipeline jobs.
- Review CloudTrail and IAM activity for suspicious key creation, unusual STS calls, or unfamiliar automation users.
- Check for abnormal outbound traffic from build systems and signs of secret-scanning tools running unexpectedly.
Immediate defensive actions
- Pin security tooling and GitHub Actions to immutable commit SHAs, not mutable tags.
- Reduce secret scope in pipelines (least privilege + short-lived credentials).
- Alert on IAM key creation/attachment events and cross-account API anomalies.
- Re-run incident-response checks even if no obvious outage occurred (this incident had no website downtime but still involved data theft).
Sources
- https://cert.europa.eu/blog/european-commission-cloud-breach-trivy-supply-chain (primary source)
- https://ec.europa.eu/commission/presscorner/detail/en/ip_26_748 (primary source)
- https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/ (primary source)
Bottom line
Supply-chain incidents can keep causing damage long after the initial compromise is disclosed. If your pipelines handled sensitive cloud credentials, treat this as a rotate-and-verify event now, not later.