Council of Europe Hacked by ShinyHunters, 297 GB of Data Stolen
The notorious extortion group ShinyHunters claimed to have hacked the Council of Europe, stealing nearly 300 gigabytes of data, including employee personal information, payroll data, CVs, and medical records. The group threatened to leak the data if negotiations were not initiated.
Signal context
First seen: Jun 14, 2026
Last updated: Jun 19, 2026
Status: Public signal
Key points
- ShinyHunters added the Council of Europe to its leak site on June 14, 2026.
- Allegedly stole over 297 GB of data (429,000 files).
- Compromised data includes payroll data for over 10,000 employees (2011-2026), 14,000+ CVs, contracts, absence/illness reports, bank account info, performance evaluations, employee names, IDs, addresses, phone numbers, dates of birth, tax/social secur
Signal analysis
BetaThis analysis groups the signal by industry, likely incident action and impacted security area. It helps compare this signal with other published signals without treating the labels as final determinations.
Sector: Health Care and Social Assistance
Likely country: Location not provided
The feed marks multiple actor roles. Treat this as a review signal rather than a final attribution.
- Source type: outside the affected organization
- Source type: possible insider or internal misuse
Impact area: Confidentiality
- 6 signals in the same sector
- 22 signals with the same likely impact area
- 1 signal linked to this organization/domain
External sources
ShinyHunters Claims Council of Europe Hack - SecurityWeekhttps://www.securityweek.com/shinyhunters-claims-council-of-europe-hack/Public source from securityweek.com.
ShinyHunters Claims Major Hack of Council of Europe, Leaks Internal Data - Reddithttps://www.reddit.com/r/PwnHub/comments/1d9x8x/shinyhunters_claims_major_hack_of_council_of/Public source from reddit.com.
Related signals
Grouped by why the signal is relevant.
Horizon Family Medical Group Data Breach
Reports emerged on June 18, 2026, of a possible data breach at Horizon Family Medical Group, a medical provider in New York's Hudson Valley region. Threat actor Incransom claimed to have stolen 7 TB of data, including medical information such as diagnoses, prescriptions, treatments, and lab results.
iRhythm Holdings Discloses Cybersecurity Incident and Data Breach
iRhythm Holdings, a heart monitoring device manufacturer, identified unauthorized access to certain third-party-hosted business applications, leading to the exfiltration of sensitive patient and proprietary data. The company received an extortion demand from a threat actor.
DentaQuest Data Breach Exposes 2.6 Million Accounts
Dental benefits administrator DentaQuest confirmed a cybersecurity incident involving unauthorized access to a portion of its network, leading to the exposure of personal and health-related information for 2.6 million individuals. The ShinyHunters extortion group claimed responsibility and leaked the data.
ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273)
The ShinyHunters threat group exploited a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft PeopleTools, a critical remote code execution flaw with a CVSS score of 9.8. The campaign, observed between May 27 and June 9, 2026, targeted over 100 global organizations, with a significant focus on the higher education sector. The vulnerability allowed unauthenticated remote code execution without user interaction. Stolen data from compromised organizations was subsequently published on ShinyHunters' data leak site, and some victims received extortion demands. Oracle released a security advisory on June 10, 2026, after the exploitation was already underway.
Oracle Health (Cerner) Legacy Server Breach
In a separate incident from the Oracle Cloud breach, Oracle Health (formerly Cerner), a provider of electronic health record (EHR) systems, experienced a data breach. A hacker reportedly used stolen credentials to access legacy servers that had not yet been migrated to Oracle Cloud, leading to the exfiltration of healthcare records from various hospitals in the United States. The incident began on January 22, 2025, and Oracle first noticed the breach on February 20, 2025. The attacker is allegedly extorting Oracle Health customers, demanding cryptocurrency payments to withhold publishing the stolen data, which likely includes protected health information.
Oracle Affected by FortiBleed Campaign
Oracle was identified as one of over 22,000 corporate domains affected by the FortiBleed campaign. A Russian-speaking criminal group compromised Fortinet firewall and VPN devices globally, exfiltrating credentials and potentially gaining full network access.