Europa.eu Breached: 350GB Stolen From the EU Commission, Citrix & F5 Exploits Hit Critical Infrastructure, AI Systems Erode Access Controls

The EU Commission — the body that writes cybersecurity regulation — has been breached by ShinyHunters, with 350GB of sensitive data stolen. Meanwhile, critical-severity zero-days in Citrix NetScaler and F5 BIG-IP are under active exploitation, Fortinet FortiClient EMS is being weaponized, and a new study reveals LLMs are silently breaking organizational access controls. Here's what it all means for NIS2, DORA, GDPR, and EU AI Act compliance.

1. Europa.eu Breached: ShinyHunters Steal 350GB From the European Commission

In what can only be described as a sobering irony, the European Commission — the institution responsible for crafting and enforcing the EU's cybersecurity regulatory framework — has itself fallen victim to a major data breach. The ShinyHunters extortion gang claimed responsibility after compromising at least one of the Commission's AWS (Amazon Web Services) accounts and exfiltrating over 350GB of data.

The stolen data allegedly includes mail server dumps, databases, confidential documents, and contracts. ShinyHunters has already published a 90GB sample archive on their dark web leak site. The Commission confirmed the breach in a press release, noting that internal systems were not affected but acknowledging that "data have been taken from those websites."

This comes just weeks after the Commission disclosed a separate breach in February involving its mobile device management platform. Two major security incidents within the same EU institution in under two months raises serious questions about the Commission's own security posture — particularly as it pushes member states toward strict NIS2 compliance.

What Organizations Should Do

• Audit AWS/cloud IAM configurations — ShinyHunters frequently exploits misconfigured SSO and overly permissive access keys
• Review third-party cloud access — Map all external services with cloud account access and enforce least-privilege
• Enable CloudTrail/audit logging — Ensure you can detect unauthorized data exfiltration from cloud storage
• Prepare your breach notification workflow — GDPR's 72-hour window starts when you become aware, not when you've finished investigating
• Conduct vishing awareness training — ShinyHunters has used voice phishing to compromise SSO accounts across 100+ organizations

2. Citrix NetScaler CVE-2026-3055: Critical Memory Flaw Under Active Exploitation

A critical-severity vulnerability in Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-3055, CVSS 9.3) is under active exploitation as of March 27, 2026. The flaw is an insufficient input validation leading to memory overread, allowing attackers to leak sensitive information from application memory — including authenticated administrative session IDs.

Successful exploitation requires the appliance to be configured as a SAML Identity Provider (SAML IDP), which narrows the attack surface but still affects a significant number of enterprise deployments. Once an attacker captures an admin session ID from memory, they can hijack the session and take full control of the appliance — including modifying traffic inspection rules, SSL certificates, and access policies.

Citrix NetScaler sits at the network edge for thousands of organizations across Europe, serving as both a load balancer and VPN gateway. Compromising these devices gives attackers a privileged position to intercept, redirect, or manipulate traffic flowing through the organization's infrastructure.

Immediate Actions

• Apply Citrix security updates immediately — prioritize appliances configured as SAML IDPs
• Review NetScaler logs for unusual memory access patterns or session hijacking indicators
• Rotate all administrator credentials and invalidate active sessions
• If you cannot patch immediately, disable SAML IDP functionality as a temporary mitigation
• Report any confirmed exploitation to your national CSIRT within the NIS2-mandated 24-hour window

3. F5 BIG-IP RCE: DoS Flaw Reclassified to Critical, Now Exploited in the Wild

In a concerning development, F5 has reclassified a BIG-IP Access Policy Manager (APM) vulnerability that was initially disclosed as a high-severity denial-of-service flaw. The vulnerability is now rated critical-severity remote code execution (RCE), and attackers are already exploiting it in the wild to deploy webshells on unpatched devices.

This reclassification matters enormously. Organizations that assessed the original DoS advisory and deprioritized patching based on a risk-acceptable DoS classification now face an entirely different threat: persistent remote access through webshells. BIG-IP appliances handle SSL offloading, load balancing, and application delivery for many of the world's largest financial institutions, healthcare providers, and government agencies.

A webshell on a BIG-IP device gives attackers the ability to intercept encrypted traffic, redirect users, inject malicious content, and pivot deeper into the internal network — all while appearing as legitimate traffic to downstream security controls.

Immediate Actions

• Patch all BIG-IP APM instances immediately — treat this as emergency priority regardless of original assessment
• Scan all BIG-IP devices for webshells and unauthorized modifications
• Review access logs for exploitation indicators dating back to the original advisory
• Implement network segmentation to limit lateral movement from compromised appliances
• Update your vulnerability management process to handle severity reclassifications with automatic re-prioritization

4. FortiClient EMS Under Active Attack: Endpoint Management Weaponized

Attackers are actively exploiting a critical vulnerability in Fortinet's FortiClient Enterprise Management Server (EMS), the centralized platform that manages Fortinet's endpoint security agents across enterprise environments. Threat intelligence company Defused confirmed active exploitation in the wild.

FortiClient EMS is particularly dangerous to compromise because it is the management plane for endpoint security. An attacker who controls EMS can push malicious configurations to all managed endpoints, disable security policies, whitelist malware, or deploy backdoors — all through the legitimate management infrastructure that security teams trust.

This attack follows a troubling trend: threat actors are increasingly targeting security management infrastructure itself rather than individual endpoints. We've seen similar campaigns against Cisco FMC, Ivanti EPMM, and SolarWinds — the tools organizations depend on to maintain security are becoming the primary attack vectors.

Immediate Actions

• Apply Fortinet's security patches for FortiClient EMS immediately
• Restrict network access to EMS management interfaces — never expose to the internet
• Audit EMS configuration for unauthorized policy changes or suspicious agent deployments
• Implement out-of-band monitoring for security management platforms
• Review your NIS2 supply chain security documentation to ensure security management tools are explicitly covered

5. Silent Drift: LLMs Are Quietly Breaking Organizational Access Control

A research study published this week reveals a critical and underappreciated risk of using Large Language Models (LLMs) in security operations: AI systems can write syntactically correct access control policies that contain subtle logical errors, quietly eroding organizational security without triggering any alarms.

The phenomenon, dubbed "Silent Drift," occurs when organizations use LLMs to generate or modify access control policies written in languages like Rego (used by Open Policy Agent) or Cedar (used by AWS Verified Access). The LLM produces policies that compile without errors and pass basic testing, but contain missing conditions, hallucinated attributes, or incorrect logical operators that grant broader access than intended.

Unlike a misconfigured firewall rule — which might be caught by traffic analysis — an overly permissive access control policy may never trigger alerts. The access it grants is technically "authorized" by the policy, even if it wasn't the administrator's intent. This creates a slow, invisible expansion of access that compounds over time as more AI-generated policies are deployed.

What Organizations Should Do

• Never deploy AI-generated access control policies without human review — treat LLM output as a draft, not a finished product
• Implement automated policy testing that validates not just syntax but semantic correctness against expected access matrices
• Maintain a version-controlled history of all access control policies with change attribution
• Conduct periodic access reviews that compare actual access patterns against policy intent
• Document your AI usage in access control for EU AI Act compliance — you'll need to demonstrate human oversight

6. CareCloud Healthcare Breach: Patient Data Stolen in 8-Hour Attack

Healthcare IT firm CareCloud has disclosed a cybersecurity incident involving one of its electronic health record (EHR) environments. The attack caused an approximately eight-hour network disruption and resulted in the theft of sensitive patient data. While the full scope is still being investigated, any breach involving EHR data is classified as among the most sensitive under both GDPR and sector-specific healthcare regulations.

Healthcare remains the most targeted sector for ransomware and data theft, with the average healthcare breach costing $10.93 million according to IBM's latest Cost of a Data Breach report. The CareCloud incident underscores that managed service providers handling healthcare data are high-value targets — compromising one MSP can expose data from hundreds of healthcare providers.

Regulation Roundup: What's Due This Week

Key Takeaways for Security Leaders