The documents were discovered a few months ago after a malicious email was caught by the Redwood City, California-based Area 1 Security firm, according to company co-founder Blake Darche.
He said the firm followed forensic clues in the message back to an unsecured server that had some 1,100 EU diplomatic cables. Darche said he believed that tens of thousands more such documents have been stolen.
"We estimate that the ones we found are a small fraction of the overall operation," he said. "From what we can see, the EU has a significant problem on their hands."
Darche said the hackers are working for China's People's Liberation Army, a judgment he said was based on eight years spent observing the group. A report published by the group Wednesday laid out the hackers' modus operandi, but attribution is notoriously fickle and others in the field voiced skepticism .
Calls to China's mission to the European Union were not returned Wednesday. Beijing has in the past denied similar reports.
EU officials are taking the report "extremely seriously" but it is "impossible to comment on leaks," European Commission Vice President Valdis Dombrovskis told reporters in Brussels.
"All communication systems have vulnerabilities, so we're constantly dealing with this challenge," he said.
Dombrovskis identified the system hit by the leaks as one managed by the European Council's secretariat, which represents EU member states in Brussels, rather than the commission itself. In an email, the council acknowledged what it described as "a potential leak of sensitive information" and said it was investigating. It offered no further comment.
The New York Times, which first reported on the breach, published excerpts of the diplomatic cables after obtaining them from Area 1 ahead of time.
Some of the messages appeared to capture European officials struggling to deal with the erratic movements of U.S. President Donald Trump.
One such document appeared to capture a senior European official in Washington recommending that envoys from the EU's member nations work around Trump by dealing directly with Congress.
In another apparent message, European diplomats described a recent summit between Trump and Russian President Vladimir Putin in Helsinki, Finland, as "successful (at least for Putin)."