ShinyHunters claims theft of 297GB of Council of Europe payroll and HR data via Oracle PeopleSoft zero-day

On 14 June 2026, the extortion crew ShinyHunters publicly claimed to have stolen roughly 297GB of data from the Council of Europe — the continent's oldest intergovernmental body, based in Strasbourg and best known for the European Convention on Human Rights and the European Court of Human Rights. The group threatened to leak the trove, setting a deadline of 16 June 2026, and the Council said it was investigating the claims.

What happened

According to ShinyHunters' own statements, the haul spans about 429,000 files with records dating from 2011 to 2026, including roughly 409,000 payslips, 14,000 CVs and 3,700 internal HR documents. The attackers say the payroll and human-resources data covers more than 10,000 current and former employees, contractors and job applicants across multiple Council entities — the Secretariat, the Human Resources Directorate, the Parliamentary Assembly and the European Directorate for the Quality of Medicines (EDQM) — and includes salary details, bank account information, tax and social security records, and personal identifiers such as names, addresses and contact details.

The intrusion is tied to CVE-2026-35273, a critical (CVSS 9.8) unauthenticated remote-code-execution flaw in Oracle PeopleSoft PeopleTools. ShinyHunters exploited the bug as a zero-day — activity observed between roughly 27 May and 9 June 2026, before Oracle's 10 June emergency advisory — to compromise more than 100 organisations running vulnerable PeopleSoft instances, many of them universities. The Council of Europe is among the most prominent victims to surface in that campaign.

Why it matters

The figures here are attacker claims and, at the time of disclosure, the Council had not confirmed what, if anything, was taken. Even so, payroll and HR datasets of this kind — bank details, tax and social security numbers, salaries and CVs spanning more than a decade — are precisely the material that fuels identity theft, fraud and follow-on phishing, and their exposure at an institution that handles sensitive human-rights and diplomatic work carries heightened risk. The case also underscores how a single PeopleSoft zero-day let one crew pivot from mass university breaches to a marquee European intergovernmental target.