European Commission Responds to Mobile Device Cyberattack

Key Findings

• The European Commission detected a cyber attack on its central mobile device management infrastructure on January 30, 2026.

• The attack may have exposed the personal details, including names and phone numbers, of some Commission staff members.

• However, the Commission's swift response contained the breach within 9 hours and ensured that no mobile devices were compromised.

• The attack is linked to critical vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti's Endpoint Manager Mobile (EPMM) software, which the Commission uses to manage employee mobile devices.

• Similar attacks have recently hit government bodies in the Netherlands and Finland, suggesting the vulnerabilities may have been exploited more widely.

Background

The European Commission, the executive branch of the European Union, is a frequent target for digital threats. This latest incident occurred just 10 days after the Commission introduced the Cybersecurity Act 2.0, a new plan to bolster the EU's defenses against large-scale cyber attacks.

The Commission uses Mobile Device Management (MDM) software, in this case Ivanti's EPMM, to control apps and security settings on the mobile devices of its employees. On January 30, 2026, the Commission detected signs of an intrusion within this central mobile infrastructure.

Vulnerability Exploited

The attack is linked to two critical vulnerabilities, CVE-2026-1281 and CVE-2026-1336, in Ivanti's EPMM software. These flaws, disclosed by Ivanti a day before the Commission's breach, allow remote code execution by an attacker without needing any credentials.

While Ivanti has released patches, the security expert David Neeson expressed concerns that the fixes are fragmented, requiring different patches for different EPMM versions. This may leave some deployments still exposed.

Swift Containment

The Commission acted quickly, securing and cleaning the affected systems within just 9 hours of detecting the intrusion. They state that no actual compromise of mobile devices was detected, suggesting the hackers were only able to access the central management platform, not the individual staff phones and tablets.

Broader Impact

Similar attacks have recently hit other government bodies, including in the Netherlands and Finland. The security watchdog Shadowserver also found evidence of the EPMM vulnerabilities being exploited on servers worldwide.

This incident serves as a reminder of the critical importance of patching vulnerabilities, especially in sensitive enterprise software like MDM platforms. The Commission has promised a full review to learn how to better protect its data in the future.

Sources

• https://hackread.com/cyber-attack-european-commission-staff-mobile-systems/

• https://securityaffairs.com/187768/data-breach/european-commission-probes-cyberattack-on-mobile-device-management-system.html

• https://news.backbox.org/2026/02/09/cyber-attack-hits-european-commission-staff-mobile-systems/

• https://thecyberexpress.com/european-commission-mobile-cyberattack/

• https://cybernews.com/security/european-commission-staff-data-breach/

• https://www.esecurityplanet.com/threats/european-commission-hit-by-mobile-management-data-breach/