coe.int Listed by shinyhunters Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
coe.int has been listed by the shinyhunters ransomware group, which claims to have exfiltrated internal files. The breach was disclosed on June 14, 2026; the number of people affected is undisclosed, and anyone who may have had data held by the organisation should verify their exposure and take protective steps.
Inside the incident
The reported incident centers on the exfiltration of internal files from coe.int systems. The listing indicates that more than 297 GB of data, comprising over 429,000 files, was removed. No confirmation of encryption or ransom demands has been made public, and the organization has not released an official statement on the event.
Timing of the intrusion, the attack vector used, and any subsequent containment steps remain undisclosed in available reporting.
Inside shinyhunters
Shinyhunters is a threat actor known for claiming access to corporate and institutional data and for advertising stolen material on underground forums. The group has been linked in public reporting to multiple prior listings involving large-scale data theft, often followed by offers to sell or share the material.
In this case the group claims responsibility for the coe.int data through its leak-site listing. Independent verification of the claim has not been published.
About coe.int
coe.int is the primary domain of the Council of Europe, an international organization whose mandate includes human rights, democracy, and legal cooperation across member states. Like similar intergovernmental bodies, it maintains human-resources records for permanent staff, temporary personnel, interpreters, and contractors.
A compromise of such records is consequential because the data relate to individuals employed or contracted across multiple countries and functions, including parliamentary and administrative operations.
The information in question
The listing describes the material as Council of Europe HR and payroll data. The facts provided name the following categories:
- More than 409,000 payslips covering 10,000-plus staff members from 2011 to 2026
- Over 14,000 CVs and 3,700 in-house personnel files
- Contract and purchase-order records, mission-travel overpayments, and interpreter scheduling documents
- Absence and illness reports together with 2026 salary scales
What's at stake
Individuals whose records appear in the dataset face the possibility that personal employment and financial details could be used for targeted fraud or identity misuse. The organization may encounter operational disruption and the need to review access controls and third-party arrangements.
Because the exact scope of distribution remains unknown, the duration and reach of any subsequent misuse cannot be quantified from current public information.
Were you affected?
Anyone who has worked with or for the Council of Europe in the periods referenced can begin by monitoring official communications from the organization. Practical first steps include reviewing bank and tax statements for anomalies and updating credentials for any associated accounts.
Readers can also run a free exposure scan of their email address against known breach data to determine whether their information has appeared in previously published datasets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Adapt****** Listed by shinyhunters Ransomware GroupBreachForums Version 5 Data Breach (2026)Questel SAS Listed by shinyhunters Ransomware GroupIngram Content Group, Inc. Listed by shinyhunters Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the coe.int Listed by shinyhunters Ransomware Group →
Publicly posted by shinyhunters — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.