The European Commission, the EU’s primary executive branch, is currently investigating a security issue. An unauthorized individual gained entry to their Amazon cloud services.

While EU officials haven’t announced the compromise, BleepingComputer has learned that at least one user account managing the affected cloud infrastructure was compromised.

Sources familiar with the event revealed to BleepingComputer that the intrusion was quickly spotted, and the Commission’s cybersecurity team is currently investigating.

Although specifics are scarce from the Commission, the perpetrator who claimed responsibility contacted BleepingComputer earlier in the week, asserting they had stolen more than 350 GB of data, including numerous databases.

The attacker did not explain how they breached the accounts, but they sent BleepingComputer screenshots as evidence of access to information about European Commission personnel and a Commission email server.

The malicious actor further informed BleepingComputer they wouldn’t try to blackmail the Commission with the purported stolen data. Instead, they intend to release it online later.

The Commission reported another data security incident in February after discovering on January 30th that the mobile device management system used to oversee employee devices was compromised.

The January incident appears related to comparable attacks aimed at other European entities (including the Dutch Data Protection Authority and Valtori, a Finnish government agency under the Ministry of Finance). These attacks leveraged code-injection flaws found in Ivanti Endpoint Manager Mobile (EPMM) software.

These current security incidents emerge shortly after the Commission put forward a January 20 proposal for updated cybersecurity laws designed to reinforce defenses against state-sponsored actors and cybercriminal groups targeting vital European resources.

Last week, the Council of the European Union also imposed sanctions on three Chinese and Iranian companies for orchestrating cyberattacks that targeted critical infrastructure in member nations.