ShinyHunters Claims 297 GB Council of Europe Data Breach
Published
Key Takeaways
- Breach Claimed: ShinyHunters claims to have breached the Council of Europe, targeting internal HR and personnel systems.
- Data Volume: The threat actor alleges exfiltration of more than 297 GB of data across approximately 430,000 files.
- Unverified Status: The claim was observed on June 14, 2026, and remains pending verification.
The threat actor known as ShinyHunters claims to have breached the Council of Europe, allegedly exfiltrating more than 297 GB of data comprising over 429,000 files, including over 409,000 payslips from more than 10,000 employees. The claim surfaced on June 14, 2026, and has not been independently confirmed.
What ShinyHunters Claims to Have Exfiltrated
According to the threat actor, the dataset pulled from the Council of Europe spans a wide range of internal employee records. The listed contents include:
- HR and payroll records,
- Payslips,
- CVs,
- Personnel files,
- Employee document repositories,
- Highly sensitive personal information, including:
- Salary records,
- Banking records,
- Tax records,
- Medical records.
If accurate, this combination would expose both administrative documentation and deeply personal data tied to staff.
A ShinyHunters spokesperson told The Register that the group infiltrated the Council systems by exploiting the Oracle PeopleSoft vulnerability tracked as CVE-2026-35273. This flaw is remotely exploitable without authentication and may result in remote code execution (RCE), according to Oracle’s advisory.
Assessing the Threat
ShinyHunters has an established reputation across the threat intelligence community for high-volume extortion and data-leak campaigns.
At this stage, the incident rests solely on assertions attributed to ShinyHunters. No validated details beyond the actor's claims are currently available, and the status remains pending verification.
In other recent news, ShinyHunters published Infinite Campus data as part of an extortion campaign linked to Salesforce. In May, the threat actor attacked Charter Communications, Kemper Corporation, Ameriprise Financial, 7-Eleven Inc., Woflow Inc., and Vimeo.
Last year, Cl0p Ransomware exploited the Oracle E-Business Suite (EBS) flaw to attack the Washington Post, a Canon subsidiary, and Logitech, among the over 100+ impacted organizations.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular