From https://www.ema.europa.eu/en/news/cyberattack-ema-update-6 the EMA has acknowledge that the individual emails are authentic, though "data from different users were selected and aggregated, screenshots from multiple folders and mailboxes have been created and additional titles were added by the perpetrators in a way which could undermine trust in vaccines."