Brussels cloud heist exposes 350 gb of eu data and the attacker isn’t even asking for ransom
Someone walked into the European Commission’s cloud stack, scooped up 350 GB of web-site data and employee records, and—unlike every ransomware crew on the planet—declared they will dump it online for free. The breach, discovered last Tuesday inside the Commission’s Europa.eu hosting cluster, has already triggered an internal incident-response war room and a quiet warning to every trade union that might find its members’ names in the haul.
Cloud gateway, not core systems, took the bullet
Early forensics show the attacker never touched the Commission’s internal mail or document vaults; they simply pried open the outward-facing cloud layer that powers hundreds of EU public sites. Brussels rushed out a mitigation playbook—patch, isolate, rotate keys—while keeping every portal live, a gamble that so far has avoided the dreaded 503 error page on citizens trying to file subsidy forms.
The intruder, chatting with BleepingComputer under a throw-away handle, served up screenshots of staff directories and what looks like an SMTP gateway to prove possession. No exploit chain was detailed, but the timestamp metadata on the images suggests the reconnaissance phase started weeks before the March 24 alarm bell.
No ransom, just reputational arson
Forget Bitcoin demands. The attacker’s stated endgame is visibility: publish everything, shame the institution, watch the diplomatic dominoes wobble. That tactic—data leak as propaganda—mirrors last winter’s raid on the European Parliament’s intranet and signals a shift toward sabotage without profit.
Commission spokespeople insist passwords were salted, databases encrypted. Yet the mere presence of staff PII in the same virtual neighbourhood as public-facing CMS tables will reopen the perennial Brussels debate: why does the EU still self-host vanity sites on shared tenants instead of air-gapped, zero-trust slices?
Next act: nis2 and cyber solidarity law on trial
Legally, the clock is ticking. Under the incoming NIS2 directive, cloud providers feeding essential government services must report material breaches within 24 hours and deliver a full post-mortem in one month. This incident lands right in the transition gap—old rules for the Commission, new rules for its suppliers—giving lawyers on both sides a regulatory maze to navigate.
Meanwhile, the Cyber Solidarity Act’s proposed “cybersecurity reserve,” a Brussels-funded swarm of incident-response teams, is still stuck in trilogue. Every gigabyte the mystery leaker drops this week will be Exhibit A for MEPs arguing the reserve can’t launch soon enough.
The Commission swears it will “feed lessons into hardening road-maps,” but road-maps don’t erase data once Telegram channels start mirroring it. 350 GB is already seeding on torrents labelled “EuropaDump”; the only unknown left is whose inbox ends up trending on Twitter tomorrow.