ShinyHunters group claims major data theft from the Council of Europe

The notorious ShinyHunters extortion group has released confidential data from the Council of Europe, claiming it gained access to the organisation’s internal network and stole hundreds of gigabytes of data.

 

Headquartered in Strasbourg, France, the Council of Europe is an international organisation dedicated to promoting human rights, democracy, and the rule of law across Europe. It is distinct from the European Union, and comprises 46 member states and oversees the European Convention on Human Rights and the work of the European Court of Human Rights.

 

Earlier this month, the ShinyHunters extortion group mentioned the Council of Europe as a victim on its data leak site, claiming that it infiltrated the council ’s internal network and stole 297 gigabytes of data. 

 

x

 

 

The threat group claimed that it stole more than 429,000 files from multiple Council of Europe divisions, including human resources, the Secretariat, the Parliamentary Assembly, and the European Directorate for the Quality of Medicines & HealthCare.

 

ShinyHunters added that the compromised database contained extensive personnel and administrative records, including salary information for over 10,000 employees spanning 2011–2026, thousands of resumes, procurement and contract documents, attendance and sick leave records, banking details, staff assessments, and payroll-related exports.

 

The hacker group also added that it stole a wide range of personally identifiable information, including employee names, identification numbers, home addresses, telephone numbers, dates of birth, tax and social insurance records, as well as sensitive medical information.

 

The group published a 4.7 GB compressed dataset on June 18, exposing 441,408 entries organised within a "COE-INT/data/" directory structure. The archive reportedly contained thousands of folders linked to case and document references spanning more than a decade, from approximately 2009 through 2025.

 

x

The data leak occurred after the cyber extortion group warned that the Council of Europe database would be made public on June 16 unless the Council paid a ransom.

 

Acknowledging the claims of the extortion group, in a statement shared with SecurityWeek, a Council of Europe spokesperson said, “We are currently investigating the matter and assessing the situation. We have no further comment to make at this stage.”