The intergovernmental body says it is probing allegations made by the prolific extortion group over the weekend.
Summary
- ShinyHunters claimed over the weekend to have breached the Council of Europe, Europe’s oldest intergovernmental organisation.
- The Council of Europe has confirmed it is actively investigating the claims.
- ShinyHunters is a well-established threat actor with a history of large-scale data theft and extortion.
- No details about the nature or volume of alleged stolen data have been confirmed by the organisation.
- The investigation is ongoing and the full scope of any potential exposure remains unknown.
What Has Been Claimed
Over the weekend, the ShinyHunters extortion group alleged it had obtained data from the Council of Europe — the Strasbourg-based intergovernmental body founded in 1949 and separate from the European Union. The group has not publicly disclosed specifics about what data it claims to hold, and the Council has not confirmed whether any systems were compromised or what categories of information may be at risk.
The Organisation’s Response
The Council of Europe has acknowledged the claims and stated it is investigating. Beyond confirming the probe is underway, the organisation has not provided further detail at this stage. The sources available do not indicate whether law enforcement has been engaged, whether a data protection authority has been notified, or what the expected timeline for the investigation is.
Who Are ShinyHunters
ShinyHunters is a well-documented threat actor group with a track record of high-profile data theft and extortion operations. The group has previously claimed responsibility for large breaches affecting millions of records across multiple sectors and geographies. Their typical pattern involves obtaining data — often through compromised credentials, misconfigured cloud storage, or third-party supply chain access — and subsequently attempting to monetise it through sale or extortion. Whether that pattern applies here is not yet established from the available source material.
What Remains Unknown
At this point, the source material does not confirm the scope, authenticity, or method of any alleged intrusion. It is not known whether the claimed data is genuine, how it may have been obtained, or how many individuals or member state delegations could be affected. The Council of Europe serves 46 member states and houses sensitive work across human rights, rule of law, and democratic governance — but speculation about what data may be involved is not supported by the available evidence.
Context for Security Leaders
Extortion groups routinely make claims that range from fully substantiated breaches to exaggerated or entirely fabricated ones. The Council of Europe’s decision to investigate publicly is a reasonable and transparent first step, though it neither confirms nor denies the validity of the claims. For CISOs in organisations with any affiliation, data-sharing arrangement, or partnership with Council of Europe bodies, this warrants attention while the investigation unfolds.
Why it matters
Intergovernmental and multilateral organisations hold sensitive data spanning member states, policy deliberations, human rights casework, and personnel records. A confirmed breach of the Council of Europe — if the claims prove substantive — would represent exposure of information touching 46 nations. Even unverified claims from a group with ShinyHunters’ track record carry reputational and operational risk for any organisation in the Council’s ecosystem. CISOs should treat this as a signal to review third-party and partner data flows with intergovernmental bodies, monitor for any downstream disclosure of data that could implicate their own staff or joint projects, and watch the investigation’s progress before drawing conclusions.
What to do now
- Monitor the Council of Europe’s official communications for updates on the investigation’s findings.
- Review any data-sharing arrangements, joint project documentation, or staff interchange your organisation has with Council of Europe bodies.
- Avoid drawing operational conclusions based on unverified claims — wait for the investigation to establish the scope and authenticity of the alleged breach.
- Consider briefing your board or risk committee on the developing situation if your organisation has direct ties to the Council of Europe or its member state delegations.
- Review your own exposure to ShinyHunters’ known tactics — credential compromise, misconfigured cloud storage, and third-party supply chain access — as a general precautionary measure.
