EU Commission Investigates AWS Cloud Breach as Council Sanctions Chinese & Iranian Cyber Firms, Revised Cybersecurity Act Targets Foreign Suppliers

The European Commission is investigating a major breach of its Amazon cloud environment with 350GB allegedly stolen — raising urgent questions about NIS2 and DORA third-party risk management. The EU Council sanctions three companies tied to state-backed cyberattacks. A proposed Revised Cybersecurity Act would mandate removing high-risk foreign suppliers from telecom networks. The CRA Administrative Cooperation Group holds its inaugural meeting, and the AI Board convenes its seventh session on EU AI Act governance.

1. European Commission AWS Breach: 350GB Data Theft Shakes EU Cloud Security Posture

The European Commission is investigating a security breach after a threat actor gained unauthorized access to at least one of its Amazon Web Services (AWS) accounts. The attacker claims to have exfiltrated over 350 gigabytes of data, including multiple databases and email server contents belonging to Commission employees.

What Happened

According to reports from BleepingComputer, the breach was detected relatively quickly by the Commission's cybersecurity incident response team. The threat actor provided screenshots demonstrating access to employee information and internal email systems. Notably, the attacker stated they would not attempt extortion but intend to leak the data publicly at a later date.

This is the second major breach at the Commission in 2026. In February, the institution disclosed that its mobile device management (MDM) platform was compromised on January 30 — an incident linked to Ivanti EPMM code-injection vulnerabilities that also affected the Dutch Data Protection Authority and Finland's Valtori agency.

Key Regulatory Takeaways

• NIS2 Article 21(2)(d): Requires "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" — AWS being a direct service provider
• DORA Article 28: Mandates that financial entities and critical institutions maintain robust contractual arrangements with ICT third-party service providers, including exit strategies and data portability
• GDPR Article 33: The Commission must notify the EDPS within 72 hours if personal data of EU citizens was compromised

2. EU Council Sanctions Chinese and Iranian Companies for State-Backed Cyberattacks

The Council of the European Union has imposed cyber sanctions on three companies and two individuals for orchestrating cyberattacks against member states' critical infrastructure — the most significant expansion of the EU's cyber sanctions regime since its 2019 inception.

Sanctioned Entities

The two sanctioned individuals are co-founders of Anxun Information Technology (i-Soon), the Chinese firm whose massive data leak in February 2024 exposed its operations as a government-affiliated hacking contractor.

Regulatory Significance

These sanctions directly reinforce the EU's evolving cyber deterrence framework under NIS2. The directive's Recital 9 explicitly references the need for coordinated responses to state-backed threats, and Article 13 tasks EU-CyCLONe (the Cyber Crisis Liaison Organisation Network) with supporting "coordinated management of large-scale cybersecurity incidents."

3. Revised Cybersecurity Act: Mandating Removal of High-Risk Foreign Suppliers

The European Commission has proposed sweeping new cybersecurity legislation that would grant it authority to mandate the removal of high-risk foreign suppliers from European telecommunications networks — moving beyond the voluntary 5G Security Toolbox introduced in 2020.

Key Provisions

• Mandatory risk assessments: EU-wide evaluations across 18 critical sectors based on suppliers' countries of origin and national security implications
• High-risk supplier removal: Authority to restrict or ban equipment from vendors deemed security risks in mobile telecom networks
• Streamlined certification: Voluntary ENISA-managed certification schemes to reduce regulatory burden
• Enhanced ENISA powers: Early threat alerts, single entry point for incident reporting, ransomware response coordination with Europol
• Cybersecurity workforce: EU-wide skills attestation schemes and a Cybersecurity Skills Academy pilot

"Cybersecurity threats are not just technical challenges. They are strategic risks to our democracy, economy, and way of life," said EU tech commissioner Henna Virkkunen. The Cybersecurity Act would take effect immediately upon approval, with member states having one year to implement amendments into national law.

How This Intersects with NIS2 and DORA

The Revised Cybersecurity Act complements rather than replaces NIS2. While NIS2 sets baseline security requirements for essential and important entities, this new Act specifically targets supply chain sovereignty at the infrastructure level. For financial institutions under DORA, the implication is clear: ICT third-party concentration risk involving non-EU suppliers will face heightened regulatory scrutiny.

4. Cyber Resilience Act: First Administrative Cooperation Group Meeting

The first meeting of the Administrative Cooperation Group for the Cyber Resilience Act (CRA) was held on March 20, 2026, marking a pivotal step in preparing for enforcement of the regulation that will impose mandatory cybersecurity requirements for all digital products sold in the EU.

What the CRA Requires

The CRA applies to all products with digital elements — from consumer IoT devices to industrial software. Manufacturers must:

• Conduct cybersecurity risk assessments before market placement
• Provide security updates throughout the product's expected lifetime (minimum 5 years)
• Report actively exploited vulnerabilities to ENISA within 24 hours
• Maintain Software Bills of Materials (SBOMs) for all products

ENISA has also launched a survey targeting SMEs to assess CRA awareness, readiness, and support needs — acknowledging that smaller businesses face disproportionate compliance burdens.

5. EU AI Board Seventh Meeting: Shaping AI Act Governance

The seventh meeting of the EU AI Board took place on March 20, 2026, bringing together member state representatives to discuss the latest developments in the Commission's AI strategy and the ongoing implementation of the EU AI Act.

Where the AI Act Stands

The EU AI Act's phased implementation continues on schedule:

The AI Board serves as the primary governance body for coordinating AI Act enforcement across member states. Key discussion topics at the seventh meeting included:

• Harmonized standards for high-risk AI system assessments
• AI regulatory sandboxes — progress on implementation across member states
• Coordination with the AI Office on codes of practice for general-purpose AI models
• Cross-border enforcement cooperation mechanisms

The Bigger Picture: EU's Regulatory Fortress Takes Shape

This week's developments illustrate how the EU's cybersecurity and digital regulation landscape is converging rapidly. Five major frameworks are now simultaneously active or entering enforcement:

The Commission's own AWS breach — while embarrassing — may actually accelerate legislative urgency. Nothing motivates regulatory action quite like being the victim yourself.