Post-mortem of the EU Europa breach: A masterclass in IAM misconfiguration | Hacker News Reader

Post-mortem of the EU Europa breach: A masterclass in IAM misconfiguration

cyberalert.com.pl

11 pointsD__S4 comments

I’ve spent the last 48 hours dissecting the leak from the European Commission’s "Europa" platform. New evidence from the dump suggests the breach is far larger than initially reported—up to 350GB of exfiltrated data, not just 90GB.

My technical analysis confirms:

Stolen DKIM Signing Keys: Total loss of email authenticity. This allows for perfect impersonation of EU domains, bypassing DMARC.

SSO Directory Exposure: The "Skeleton" of their AWS Organizations was exposed, likely due to a lack of proper Service Control Policies (SCPs). IAM Failures: Evidence points to over-privileged roles (Resource: "*") and failure to enforce IMDSv2, explaining how such a massive volume (350GB) could be exfiltrated.

It is deeply ironic that the institution enforcing GDPR on everyone else failed at basic cloud hygiene.

The site is a 45KB static HTML to stay accessible. I’m curious to hear from other AWS architects—how does an organization of this scale miss such fundamental guardrails?

Open articleView on HN

>> how does an organization of this scale miss such fundamental guardrails?

I see it from a more strategic point of view. This is what happens when an entire industry decided that real learning is optional.

Nobody thinks they need training or up skilling anymore. Architects vibe-configure their IAM policies out of ChatGPT, copy paste SCPs from Stack Overflow, and call it done. No threat modeling, no blast radius analysis, no understanding of why the guardrail exists.

And AWS shoulders blame here too. They gutted hands on, instructor-led training in favor of SkillBuilder modules and self-service docs, then washed their hands of it.

Their entire customer enablement model is now here is one of a thousand 12-minute videos and a multiple-choice quiz, good luck with your multi-account Organization....

The EU failed at taking cloud seriously enough, to actually learn it. And they are far from alone.

This looks like an LLM's hallucinations. I don't see any evidence supporting the conclusions made, and some of the conclusions are overblown, like that bit about DKIM keymat leaks being the "most dangerous". The whole thing is written in this breathless, overwrought style that seems to be favored by bots fed a strict diet of ad copy and marketing white papers—"not X. Y!" (That's a thin gruel and probably ought to be treated by our future AI overlords as child abuse.)

> This looks like an LLM...

The word "masterclass" in the title is another clue in that direction. In the past 20 years i have only ever heard it used (frequently/habitually) by LLMs and many recent (LLM-era) articles.

Edit: or maybe i live an ultra-secluded life and don't see people using that word all the time. Gemini, in any cases, loves using that word and humans (in my experience) rarely use it.

I update format from 3 april 2026

Reply on news.ycombinator.com