European Commission AWS Breach Exposes 350GB of Data, TP-Link Router Flaws Allow Auth Bypass, BIND DNS Memory Exhaustion, Google Sets 2029 Quantum Deadline

The European Commission is investigating its second major breach in two months after a threat actor exfiltrated over 350GB from its Amazon cloud environment. TP-Link patches high-severity router vulnerabilities enabling authentication bypass and arbitrary command execution. BIND DNS resolvers face memory exhaustion from crafted domains. Google draws a line in the sand with 2029 as its quantum-safe cryptography migration deadline. RSAC 2026 Days 3–4 bring major announcements reshaping the defensive landscape.

1. European Commission AWS Environment Breached — 350GB of Data Stolen

The European Commission is actively investigating a security breach affecting at least one of its AWS accounts, BleepingComputer reported on March 27. The threat actor, who contacted journalists directly, claims to have exfiltrated over 350GB of data including employee information, multiple databases, and access to an internal email server.

What We Know

• The breach was quickly detected and the Commission's CSIRT team is investigating
• The threat actor provided screenshots showing access to employee data and an email server
• AWS confirmed its services "operated as designed" — the compromise was on the Commission's side
• The attacker stated they do not intend to extort the Commission but plan to leak the data publicly
• The attack vector has not been disclosed

Pattern of EU Breaches

This is the Commission's second breach since January 2026. The first, disclosed in February, involved the compromise of a mobile device management (MDM) platform used to manage staff devices. That breach has been linked to exploitation of Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities and is connected to similar attacks hitting the Dutch Data Protection Authority and Finland's Valtori government agency.

The pattern is clear: EU institutions are being systematically targeted. The Commission proposed new cybersecurity legislation on January 20 to strengthen defenses, and just last week the Council of the EU sanctioned three Chinese and Iranian companies for cyberattacks against member states' critical infrastructure.

Defensive Actions

• Organizations relying on cloud infrastructure should audit IAM configurations and enforce least-privilege access
• Enable CloudTrail logging and anomaly detection for all AWS accounts
• Implement SCPs (Service Control Policies) to restrict bulk data exfiltration
• Review and rotate credentials for any services with access to EU government data

2. TP-Link Patches High-Severity Router Vulnerabilities

TP-Link has released firmware updates addressing multiple high-severity vulnerabilities across several router models. The flaws, reported by SecurityWeek, represent a significant risk given TP-Link's massive market share in consumer and small-business networking equipment.

Vulnerability Details

• Authentication bypass: Attackers can skip login entirely and access the router's management interface without credentials
• Arbitrary command execution: Post-authentication (or chained with the auth bypass) flaws allow executing system commands on the router's OS
• Configuration file decryption: Encrypted router backups can be decrypted, exposing stored Wi-Fi passwords, admin credentials, and VPN keys

Why This Matters

Compromised routers serve as persistent network footholds. Threat actors — particularly state-sponsored groups like Volt Typhoon — have extensively used compromised SOHO routers to proxy their traffic and maintain access to target networks. TP-Link routers are among the most widely deployed globally, making these flaws high-value targets for botnet operators and APT groups alike.

Defensive Actions

• Update firmware immediately on all TP-Link routers in your environment
• Disable remote management interfaces if not strictly required
• Change default credentials and use strong, unique passwords
• Monitor for unexpected configuration changes or DNS modifications on network edge devices
• Consider network segmentation to isolate IoT/SOHO devices from critical infrastructure

3. BIND DNS Resolver Vulnerabilities Enable Memory Exhaustion Attacks

The Internet Systems Consortium (ISC) has patched high-severity vulnerabilities in BIND, the most widely deployed DNS software on the internet. The flaws could be exploited to cause out-of-memory conditions and memory leaks in resolvers, effectively denying DNS resolution for entire networks.

Attack Mechanism

The vulnerabilities can be triggered by specially crafted domain names that cause the resolver to consume excessive memory during processing. Since DNS resolvers must handle queries for arbitrary domains, an attacker simply needs to direct queries toward malicious domains they control — no authentication or special access required.

Impact Scope

• BIND powers DNS resolution for a significant portion of the internet's infrastructure
• A compromised resolver can cause cascading failures — if DNS stops working, everything stops working
• ISPs, enterprises, and cloud providers running BIND resolvers are all potentially affected
• Memory leaks may accumulate over time, making detection difficult until the resolver crashes

Defensive Actions

• Patch BIND immediately to the latest version
• Monitor resolver memory usage for anomalous growth patterns
• Implement rate limiting on recursive queries
• Consider deploying Response Rate Limiting (RRL) and query logging for forensics
• Ensure redundant DNS infrastructure is in place to survive individual resolver failures

4. Google Sets 2029 as Quantum-Safe Cryptography Migration Deadline

Google has publicly committed to 2029 as its target year for completing the migration to quantum-safe cryptography across its services. The announcement, highlighted in SecurityWeek's weekly roundup, signals that one of the world's largest technology companies sees the quantum threat as materially closer than many organizations assume.

The "Harvest Now, Decrypt Later" Clock

The urgency stems from the "harvest now, decrypt later" strategy that nation-states are already executing. Encrypted communications intercepted today — diplomatic cables, corporate strategies, classified intelligence — will become readable once sufficiently powerful quantum computers arrive. If that threshold is crossed by the early 2030s, data encrypted today with traditional algorithms is already at risk.

Industry Context

• NIST finalized its post-quantum cryptographic standards (ML-KEM, ML-DSA, SLH-DSA) in 2024
• The US government mandated federal agencies begin quantum-safe migration planning
• Google's 2029 deadline suggests they believe quantum threats could materialize in the early 2030s
• Most enterprises have not yet begun cryptographic inventory audits, let alone migration planning

What Organizations Should Do Now

• Conduct a cryptographic inventory — identify where RSA, ECDSA, and other vulnerable algorithms are used
• Prioritize long-lived secrets (signing keys, certificate authorities, archived data) for early migration
• Test hybrid key exchange (classical + post-quantum) in non-production environments
• Engage vendors on their quantum-safe roadmaps — if they don't have one, that's a risk signal
• Factor quantum migration into procurement decisions for new infrastructure

5. RSAC 2026 Days 3–4: Key Announcements Reshaping Enterprise Security

The final days of RSAC 2026 in San Francisco delivered a wave of product announcements and strategic shifts that will shape enterprise security through the rest of the year and beyond.

Notable Announcements

• Anti-deepfake hardware chips: A new class of hardware-level authentication chips designed to detect and prevent deepfake content at the silicon level — a potentially transformative countermeasure as synthetic media attacks scale
• Palo Alto recruiter scam warnings: Social engineering campaigns impersonating Palo Alto Networks recruiters targeting security professionals — a reminder that the security community itself is a high-value phishing target
• Heritage Bank data breach disclosed: New breach notifications surfacing from financial sector incidents, underscoring ongoing targeting of banking infrastructure
• New State Department cyber unit: The US State Department has launched a dedicated unit to tackle international cyber threats, signaling increased government investment in diplomatic cyber operations
• LA Metro disruptions: Cybersecurity-related disruptions affected Los Angeles Metro transit systems, highlighting the growing risk to public transportation infrastructure

Trends to Watch

RSAC 2026 reinforced several themes: the acceleration of AI in both offensive and defensive security, the growing consensus that quantum preparedness must begin now, and the increasing sophistication of supply chain attacks targeting developer tooling. The conference also highlighted a growing gap between security vendors' capabilities and most organizations' ability to deploy and operationalize them.

Threat Landscape Summary