The European Commission, the EU’s leading administrative body, is investigating a security issue after an intruder accessed their cloud infrastructure on Amazon.

While the EU’s governing body hasn’t made a public statement, BleepingComputer has found out that the intrusion impacted at least one account used to oversee the affected cloud infrastructure.

Sources familiar with the event told BleepingComputer that the attack was quickly identified and the Commission’s cybersecurity team is currently investigating.

Although the Commission has not released any information about this breach, the individual claiming responsibility for the attack contacted BleepingComputer earlier in the week, claiming to have stolen more than 350 GB of data (including numerous databases).

They did not reveal how they compromised the affected accounts, but they provided BleepingComputer with several screenshots as evidence of access to information belonging to European Commission staff and to an email server utilized by Commission employees.

The attacker also informed BleepingComputer that they will not try to demand money from the Commission using the allegedly hacked data, but plan to release the data online at a later time.

The Commission revealed another data security problem in February after discovering on January 30 that the mobile device management system used to administer its employee’s devices was hacked.

The incident in January seems connected to similar attacks on other European organizations (including the Dutch Data Protection Authority and Valtori, a Finnish government agency linked to the Finance Ministry) that exploited vulnerabilities within Ivanti Endpoint Manager Mobile (EPMM) software through code injection.

These recent security problems follow the Commission’s January 20 proposal for new cybersecurity laws to reinforce protection against foreign government-backed actors and cybercriminals targeting important European infrastructure.

The Council of the European Union also imposed sanctions on three Chinese and Iranian companies last week for planning cyberattacks on critical infrastructure of member countries.