Between January 30 and February 6, 2026, CERT-EU detected and responded to an attack targeting the shinyhunters-breach/" class="zt-cross-link">European Commission's central Mobile Device Management (MDM) infrastructure. The attackers exploited suspected critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) - CVE-2026-1281 and CVE-2026-1340 - to gain access to the MDM platform managing mobile devices for EC staff across Brussels, Luxembourg, and EU delegations worldwide. CERT-EU contained the attack within 9 hours.
KEY FACTS
- WhatAttack on EC's central MDM infrastructure via suspected Ivanti EPMM vulnerabilities.
- DataStaff names, phone numbers, business email addresses exposed.
- ResponseCERT-EU contained attack within 9 hours; no propagation to other EU networks.
- Vulns
CVE-2026-1281andCVE-2026-1340(critical remote code injection).
WHAT WAS EXPOSED
- Names of European Commission staff members across all Directorates-General
- Phone numbers for officials involved in trade negotiations, competition enforcement, foreign affairs, and defense cooperation
- Business email addresses (@ec.europa.eu) enabling targeted spear-phishing
- Device enrollment metadata including device types, OS versions, and MDM policy assignments
Direct phone numbers for Commission officials involved in trade negotiations with the US, China, and the UK, or defense policy coordination are intelligence targets for nation-state actors.
TECHNICAL FAILURE CHAIN
- Ivanti EPMM vulnerabilities - continuation of Ivanti's troubled security track record since 2023
- MDM as a high-value infrastructure target - compromising MDM yields enrollment database, contact directory, and device inventory
- 9-hour containment - effective by government standards but sufficient for full database extraction
- Broader MDM targeting pattern - endpoint management platforms increasingly weaponized in 2026
REGULATORY EXPOSURE
- Regulation (EU) 2018/1725 - Data protection rules for EU institutions
- European Data Protection Supervisor (EDPS)supervisory authority for EU institutions
- NIS2 Directive - credibility problem for the enforcement body
- EU Cybersecurity Act - questions about procurement standards for IT products
ZERO|TOLERANCE Advisory
MDM Platform Security Hardening - network isolation, continuous vulnerability scanning
Vendor Security Assessment - Ivanti's track record should have triggered reassessment
Zero Trust for Management Infrastructure - hardware MFA, device certificates
Threat Intelligence Integration - Ivanti exploitation tracking since July 2023
SOURCES
BleepingComputer, The Register, Security Affairs, IT Security Guru