ShinyHunters claims Council of Europe hack

Personal data exposed in breach at continent's pre-eminent human rights body

Prolific cyber gang ShinyHunters claims to have hacked and stolen personal data from the Council of Europe, which protects human rights across the continent.

The CoE, which is not affiliated with the European Union, represents 46 European nations. It markets itself as the “guardian of human rights, democracy and the rule of law,” making the latest data breach an ironic sore spot.

According to a post on ShinyHunters’ dark web leak site, the hacker collective claims to have accessed nearly 300GB of HR and payroll data and to have stolen more than 429,000 files.

There is no information how ShinyHunters accomplished the claimed breach, but Damian Skeeles - senior solution engineering manager at Filigran – believes the CoE has fallen victim to the same vulnerability the group leveraged to compromise the University of Nottingham last week.

“This looks like another victim of a vulnerability in Oracle Peoplesoft, CVE-2026-35273, which ShinyHunters claim to have used to compromised over 100 victims.

“The University of Nottingham was the first announced; the Council of Europe may be another, and we'll have to see if further victims are revealed.”

Internal data leak could affect ongoing cases

The stolen files contain reams of personal and internal information. They include 15 years of payslips for more than 10,000 staff (409,000 files); over 14,000 CVs; 3,700 personnel files; and 10,700 other documents.

ShinyHunters’ post says it has “mission travel overpayments, interpreter scheduling and 2026 salary scales, Blue List rosters, absence and illness reports, bank account and URSSAF payroll data, performance evaluations, and payroll exports.”

This gave ShinyHunters access to personal information including:

• Full names
• Employee IDs
• Home addresses
• Phone numbers
• Dates of birth
• Salaries
• Bank details
• Tax and social security information
• Medical records
• Mission references
• And other internal data

The personal data leak is bad enough, putting those affected at risk of identity theft and scams among other attacks. But the internal data is just as dangerous due to the CoE’s work on sensitive human rights cases.

Cyber attackers could sell this information to malicious third parties seeking to influence such cases through blackmail and targeted threats.

Javvad Malik, lead CISO advisor at KnowBe4, said, “This is where cybersecurity becomes very human. Organisations need to move quickly to validate the incident, communicate clearly with those affected, and help staff recognise the likely follow-on attacks. The breach may start with data, but the next target is trust.”