CERT-EU Confirms Trivy Supply Chain Attack Led to European Commission AWS Breach

**Executive summary:** A supply-chain compromise of the open-source scanner Trivy allowed TeamPCP to obtain AWS secrets and exfiltrate ~340 GB of uncompressed data from the European Commission’s hosting environment (impacting up to 71 clients); the dataset was later published by the extortion group ShinyHunters, exposing personal data and outbound email files and prompting CERT-EU coordinated incident response and remediation guidance.