INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

European Commission Discloses Staff Data Breach Exposing Personal Information

| 2026-02-09 09:49 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
A data breach was discovered at the European Commission on January 30, where attackers exploited vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) software to access employee names and business email addresses of nearly 50 employees from two Dutch authorities. The attack is believed to be linked to similar attacks targeting other institutions that exploit these same vulnerabilities. Ivanti had warned of the critical vulnerabilities CVE-2026-1281 and CVE-2026-1340 on January 29, which were exploited in zero-day attacks. The breach was contained within nine hours by the Commission's swift response, with no compromise of mobile devices detected.
Technical Mitigations AI-generated
• Patch Ivanti Endpoint Manager Mobile (EPMM) to address CVE-2026-1281 and CVE-2026-1340 vulnerabilities. • Monitor for code-injection attacks targeting EPMM servers using techniques such as network traffic analysis or endpoint monitoring tools. • Block or hunt for suspicious activity related to the exploitation of Ivanti EPMM vulnerabilities, including indicators such as unusual login attempts or unauthorized access to employee data.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-1340CVE-2026-1340 CVE-2026-1281CVE-2026-1281
Target & Sectors
Global Scope
Incident Timeline
‎2026/02/09
Threat actors exploited vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) software to access employee names, business email addresses, and telephone numbers.
infrastructure Ivanti
Internet security watchdog Shadowserver revealed over the weekend that it had found more than 50 Ivanti EPMM servers that were likely compromised in CVE-2026-1281 attacks.
…not disclosed how attackers gained access to the mobile device management platform, the incident appears to be linked to similar attacks targeting European institutions that exploit vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) software.
They also confirmed the attackers exploited Ivanti EPMM vulnerabilities to access employee names, business email addresses, and telephone numbers.
When asked whether the January cyberattack targeted the European Commission's Ivanti EPMM servers, a European Commission spokesperson referred BleepingComputer to the press release issued on Friday.
infrastructure 50 Ivanti EPMM servers
Internet security watchdog Shadowserver revealed over the weekend that it had found more than 50 Ivanti EPMM servers that were likely compromised in CVE-2026-1281 attacks.
Tactical Metrics
Metrics
infrastructure
​Ivanti
Affected Product
Ivanti, which provides enterprise mobility management software to many government and corporate clients worldwide, warned on January 29 of two critical vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM) tha…
…not disclosed how attackers gained access to the mobile device management platform, the incident appears to be linked to similar attacks targeting European institutions that exploit vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) software.
They also confirmed the attackers exploited Ivanti EPMM vulnerabilities to access employee names, business email addresses, and telephone numbers.
When asked whether the January cyberattack targeted the European Commission's Ivanti EPMM servers, a European Commission spokesperson referred BleepingComputer to the press release issued on Friday.
Internet security watchdog Shadowserver revealed over the weekend that it had found more than 50 Ivanti EPMM servers that were likely compromised in CVE-2026-1281 attacks.
Metrics
infrastructure
50
Ivanti Epmm Servers
Internet security watchdog Shadowserver revealed over the weekend that it had found more than 50 Ivanti EPMM servers that were likely compromised in CVE-2026-1281 attacks.
Intelligence Sources
BleepingComputer 2026-02-09