Cybercriminals allege hacking of EU police agency, posting data online

The European Union’s agency tasked with fighting cybercriminals suffered a hack of its own.

EU law enforcement agency Europol suffered a recent data breach in which hackers infiltrated internal platforms, it confirmed to POLITICO. The hackers posted data on an online forum popular with cybercriminal groups and said they sold data, some of which they claimed were classified records.

The group that infiltrated the platforms, IntelBroker, is a cybercriminal group known for stealing sensitive data that is thought to be behind recent hacks of General Electric and stolen sensitive military files belonging to the U.S. Defense Advanced Research Projects Agency (DARPA).

It posted screenshots of an internal Europol platform SIRIUS, which acts as a central reference point for police to access cross-border, electronic evidence. The post, seen by POLITICO, shows screenshots of the Europol Platform for Experts (EPE), private messaging exchanges, and the EC3 SPACE (Secure Platform for Accredited Cybercrime Experts) that allegedly contains 9,128 records including names of law enforcement officials with their titles. Europol, based in The Hague, is the EU’s second-largest agency.

As of publication, the EPE website was down due to site maintenance while the leaked data had been marked as sold on the hacker forum. 

In a statement to POLITICO, Europol spokesperson Jan Op Gen Oorth said that the agency was aware of the incident, which "took place recently and was discovered immediately," and added it was now assessing the situation.

“Neither Europol’s core system nor operational systems were hacked, which means no operational data from Europol has been compromised,” he added.

Some of the platforms claimed to have been hacked by IntelBroker are part of the tools of Europol’s European Cybercrime Centre (EC3), the agency’s department that fights cybercrime and cybersecurity issues.

It is the second recent data breach that Europol has been victim of. In March, POLITICO reported that a clutch of highly sensitive files containing the personal information of top law enforcement executives went missing last summer, including the hardcopy personnel file of Executive Director Catherine De Bolle.

The European Data Protection Supervisor, which oversees data protection issues at EU agencies, said it was not in a position to comment on the incident.