Overview
The European Commission announced that its central infrastructure for managing staff mobile devices showed traces of a cyber‑attack on 30 January. While personal data such as names and phone numbers may have been accessed, the Commission says no mobile devices were compromised and the incident was contained within nine hours.
Timeline of Events
Key dates in the breach are:
- 29 January – Ivanti releases advisory for two critical zero‑day vulnerabilities (CVE‑2026‑1281, CVE‑2026‑1340) in Ivanti Endpoint Manager Mobile (EPMM).
- 30 January – Commission’s mobile‑device platform detects traces of an attack.
- 31 January – Commission confirms containment, cleaning of the system, and no device compromise.
- Early February – Dutch Data Protection Authority and Council for the Judiciary report identical breaches exploiting the same Ivanti flaws.
Technical Details of the Vulnerabilities
Ivanti disclosed two code‑injection flaws that allow unauthenticated remote code execution on unpatched EPMM installations. Attackers can inject malicious payloads, gain administrative control, and exfiltrate data stored in the management console.
Impact and Response
The breach exposed staff personal information (names, business email addresses, telephone numbers) but did not affect the integrity of the managed mobile devices. The Commission’s rapid response limited the exposure to a nine‑hour window, and the platform was cleaned and restored.
Related Incidents
Similar attacks have hit other European institutions:
- Dutch Data Protection Authority – employee data accessed via Ivanti EPMM.
- Council for the Judiciary – same data set compromised.
These incidents underscore the broader risk to public‑sector agencies that rely on the same endpoint‑management software.
Recommendations
- Patch immediately – apply Ivanti’s security updates for CVE‑2026‑1281 and CVE‑2026‑1340.
- Conduct a thorough inventory of all EPMM deployments and verify version compliance.
- Implement network segmentation to isolate management consoles from general user traffic.
- Enable multi‑factor authentication for administrative access to mobile‑device platforms.
- Monitor logs for anomalous activity and establish rapid incident‑response playbooks.