Loading story…
ShinyHunters claimed it breached the Council of Europe and stole roughly 297 GB of data, saying it exfiltrated more than 429,000 files from multiple departments and threatening to publish the material unless the organization makes contact by June 16. The gang’s leak-site post described a haul spanning the Secretariat, human resources, payroll administration, parliamentary and conference-related units, and said the cache includes payslips, personnel files, CVs, payroll exports, contract records, and performance evaluations affecting more than 10,000 staff.
The allegedly stolen records contain highly sensitive personal data, including names, addresses, dates of birth, salaries, bank details, tax and social security information, and medical or absence records. The Council of Europe said it is investigating the claims and had not confirmed a breach at the time of reporting, while the incident was linked in coverage to ShinyHunters’ broader run of extortion and data-theft operations involving Salesforce-related intrusions, Snowflake customer breaches, and reported exploitation of an Oracle PeopleSoft zero-day.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
After the alleged ransom deadline passed, ShinyHunters reportedly published a 4.7 GB compressed dataset tied to its claimed Council of Europe breach. The leaked archive was said to contain more than 429,000 files spanning multiple divisions and years, including sensitive personnel, financial, and medical information.
Xakep reported that ShinyHunters said the alleged Council of Europe breach was carried out via Oracle PeopleSoft zero-day CVE-2026-35273. The report also said Google Threat Intelligence Group and Mandiant observed exploitation of the flaw from at least 2026-05-27 through 2026-06-09.
The Council of Europe told BleepingComputer it was investigating and assessing ShinyHunters' claims but had not confirmed that a breach occurred. SecurityWeek likewise reported that the organization had not publicly acknowledged the incident at the time of reporting.
ShinyHunters posted that it had stolen roughly 297 GB of Council of Europe data, including more than 429,000 files from HR, payroll, and other departments, and threatened to publish the data unless contacted by June 16, 2026. The claimed haul allegedly affects over 10,000 staff and includes sensitive personal, financial, and medical information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcetechrepublic.com
Open sourcexakep.ru
Open sourcesecurityweek.com
Open sourcebleepingcomputer.com
Open sourcemalware.news
Open sourcehookphish.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Crunchbase** confirmed a cybersecurity incident after the **ShinyHunters** cybercrime group claimed it stole **over 2 million personal records**. ShinyHunters reportedly posted a **402 MB compressed archive** online after an extortion attempt failed, and Crunchbase stated the threat actor **exfiltrated certain documents from its corporate network**. Crunchbase said business operations were not disrupted, the incident was **contained**, external cybersecurity experts were engaged, and **federal law enforcement** was notified while the company reviews the exposed data to determine required legal notifications. In a separate ShinyHunters-linked extortion case, French crypto tax platform **Waltio** was reported to be facing a ransom threat tied to alleged theft of personal data for **nearly 50,000 users**, including threatened exposure of users’ **2024 tax reports**. Waltio stated its services and production systems remained secure and that **no sensitive banking or crypto access data** was compromised. The activity aligns with ShinyHunters’ established pattern of **data theft and leak-site pressure** when ransom demands are not met.
Jun 29, 2026
ShinyHunters publicly leaked data from **Moody Bible Institute** after a "pay or leak" extortion attempt, exposing more than **2.3 million unique email addresses** along with names, physical addresses, phone numbers, dates of birth, and other personal details tied to donors, supporters, students, and alumni. Moody said it brought in internal and external cybersecurity specialists to investigate the breach and respond to the disclosure. The same threat activity has also been linked to attacks on **Oracle PeopleSoft** deployments, with the **National Association of Insurance Commissioners (NAIC)** saying attackers exploited a **zero-day** flaw to gain temporary access to part of its IT environment and steal confidential financial reporting, credit rating agency, and technical data that was later published online. NAIC said the intrusion was part of a broader campaign affecting multiple organizations after ShinyHunters claimed compromises of more than 100 PeopleSoft installations worldwide; the organization said no personally identifiable information or payment account data was involved, remediated affected systems with outside experts, and said the **FBI** was investigating.
Jul 10, 2026
**Ernst & Young (EY)** is facing a claimed extortion campaign from **ShinyHunters**, which says it stole employee credentials and sensitive files and has threatened to leak the data unless the firm makes contact by **July 31**. A posting attributed to the group warned of both public data exposure and additional digital disruption, while identifying `ey.com` as the affected domain. The claim follows EY's earlier disclosure that attackers gained unauthorized access to a third-party IT service management platform between **March 28 and April 12, 2026**, with anomalous activity detected on **April 23**. EY said documents linked to numerous tax clients were downloaded from support tickets containing tax records and personal and financial data, including names, addresses, Social Security numbers, and payment card details. The firm notified regulators in California and Texas, said at least **1,366** residents across multiple U.S. states were affected, and offered two years of credit monitoring and identity restoration; EY has not confirmed ShinyHunters' involvement, and no leaked data had been observed on underground forums at the time of reporting.
Jul 29, 2026