EU Commission Breach: 350GB Stolen, DKIM Keys Exposed (Explained)

The European Commission spends its days telling companies how to protect data. It wrote GDPR — the regulation that has fined Google, Meta, and Amazon billions of euros for failing to secure personal information. It demands transparency. It demands breach notifications within 72 hours.

On March 24, 2026, someone broke into the Commission's own house and took 350 gigabytes of data.

Three days later, the Commission confirmed it. In the vaguest statement possible. Without answering a single press question.

Root Cause — A Basic Mistake, Not Advanced Hacking

This breach was most likely caused by over-permissive cloud access controls combined with insufficient monitoring of data access and exfiltration. Amazon confirmed their systems worked normally throughout. The failure was in how the Commission configured its own environment on top of AWS infrastructure — who had access, what permissions they held, and what triggered an alert.

Renting an office building with strong locks does not mean you are secure. If you leave a window open, or give access keys to more people than necessary, or store confidential files in a publicly accessible lobby — that is not the landlord's failure. The building was secure. Your use of it was not.

ShinyHunters found the open window, walked in, and extracted 350 gigabytes before anyone noticed.

What Was Stolen — And Why DKIM Matters Most

The Commission said only that "data have been taken from those websites." Independent researchers who reviewed attacker evidence reported the following:

• Email content — actual messages between EU officials. Policy negotiations, internal discussions, regulatory decisions in progress.
• Staff personal data, contracts, internal documents — the everyday material of institutional life, now outside it.
• SSO user directory — account details for EU institutional staff across systems.
• Athena military financing data — the EU mechanism for funding military operations across member states. This raises geopolitical concerns well beyond a standard data breach.
• DKIM signing keys — this is the most dangerous item on the list, and the least reported.

A DKIM key is the digital signature that proves an email genuinely came from the domain it claims. Think of it as a wax seal on a letter — if the seal matches, email security tools mark it as legitimate.

If attackers hold the Commission's DKIM keys, they can now send emails that appear to come from official EU addresses and pass every standard security check. Your email app will see the correct seal and approve it. This gives attackers the ability to impersonate EU officials convincingly to anyone in the world — for fraud, phishing, or disinformation — with no technical way for recipients to detect it.

The data already taken is serious. The DKIM keys are a capability that will be used.

Why ShinyHunters Is Different

Most criminal groups want money. ShinyHunters, in this case, made no ransom demand. They say the data will be released publicly at a time of their choosing. This is not financial crime — it is reputational and geopolitical attack, timed for maximum impact on an institution that positions itself as the standard-bearer for digital governance.

We covered ShinyHunters last week in the Crunchyroll and Telus breach — same group, same pattern, cloud environments targeted at scale:

→ Your Anime Account Wasn't Hacked. Your Support Vendor Was.

Two Breaches in Sixty Days

January 30 — the Commission's mobile device management platform compromised. March 24 — 350GB taken from cloud infrastructure. Two successful attacks on the same institution in under two months is not bad luck. It is a pattern pointing to systemic gaps in how access is controlled, how environments are monitored, and how quickly unusual activity triggers a response.

The Commission manages trade negotiation data, regulatory enforcement decisions, diplomatic communications, and policy discussions affecting 450 million people. That information has now been successfully targeted twice this year.

The GDPR Problem

GDPR requires breach notification within 72 hours. The Commission detected the breach on March 24, confirmed it on March 27 — exactly 72 hours. The minimum legal requirement, met to the minute.

Their public statement contained no information about what data was taken, how many people are affected, or how the breach occurred. The European Commission did not respond to questions from The Register.

This is minimum legal compliance — not the level of transparency the Commission enforces on others. For an institution that has fined private companies billions for insufficient data protection and inadequate breach communication, issuing a two-sentence statement and going silent does not meet the standard it applies to everyone else.

What You Should Do Right Now

If you have ever interacted with EU institutions through Europa.eu — submitted documents, applied for EU funding, or corresponded with Commission staff — your data may be among what was taken. No individual notifications have been made.

Be extremely cautious about emails appearing to come from EU domains in the coming weeks. The stolen DKIM keys mean attackers can send emails from ec.europa.eu or europarl.europa.eu addresses that pass all standard security checks. Do not click links in such emails. Navigate directly to official websites instead.

If your organisation deals with EU institutions — legal, financial, government, procurement — brief your team on this risk now. The impersonation capability created by the DKIM keys is ready to use.

The ZyberWalls Perspective

Three things stand out.

First — this was not sophisticated hacking. It was a misconfigured cloud environment. No zero-day exploit, no nation-state tooling, no months of preparation. Just an unlocked door that a motivated attacker found by looking. Cloud misconfigurations are extremely common in large institutions. But the consequences of finding one here are obviously severe.

Second — the DKIM keys are the real long-term damage. Data can be secured after a breach. A signing key that allows indefinite impersonation of official communications is a different category of harm entirely. Watch for emails from EU domains in the weeks ahead. If something asks you to click a link or enter credentials — go directly to the official website instead.

Third — the institution that governs privacy for 450 million people needs to be held to the standard it sets for others. Not harshly. Not politically. But honestly.

This breach didn't start with advanced hacking. It started with a basic mistake.

And that's exactly why it matters.

→ The Stryker Cyberattack: How Iran-Linked Hackers Turned a Medical Giant's Own Tools Against It