Council of Europe
ShinyHunters dumps 297GB of HR files from Europe's oldest human rights organization—payslips, CVs, and financial records for staff across 46 member states.
What happened?
ShinyHunters claimed a breach of the Council of Europe, exfiltrating 429,000 files totaling 297GB. The Council of Europe is an international organization founded in 1949, headquartered in Strasbourg, with 46 member states. It focuses on human rights, democracy, and rule of law across Europe.
The breach targeted HR systems, exposing payslips, personnel records, CVs, and financial information for staff working across the organization's operations.
What data was actually inside?
Payslips revealing salaries, deductions, and banking details. HR records containing employment history, performance reviews, and personal information. CVs with career histories, contact details, and educational backgrounds. Financial information related to employee compensation and benefits.
429,000 files represents comprehensive personnel documentation accumulated over years of operations. The Council employs thousands of staff across its Strasbourg headquarters and field operations—each with extensive HR documentation now potentially exposed.
Who gets hurt and how?
Council of Europe employees whose salaries, banking details, and career histories are now exposed. Staff who work on sensitive human rights issues—some of whom may face risks in certain member states—whose employment is now documented in leaked files.
International organization staff often come from diverse backgrounds. CVs reveal citizenship, education, and career paths. For staff from countries with authoritarian governments, employment with a human rights organization creates personal risk that exposed personnel files compound.
What did they think they were doing right?
International organizations operate under frameworks designed to protect their operations and personnel. The Council of Europe maintains IT security appropriate for diplomatic and legal work. They handle sensitive human rights documentation regularly.
But HR systems often receive less security focus than operational systems. Payroll, personnel files, and CVs are "administrative" rather than "sensitive"—until they're breached. The data that enables employment is also the data that creates exposure.
What did they not know about their own data?
HR systems accumulate decades of personnel files. Past employees, applicants, contractors, seconded staff from member states. Payslips from years of operations. CVs submitted by applicants who were never hired. The data footprint of a 75-year-old organization is substantial.
429,000 files suggests historical depth far beyond current employment. How long should payslips be retained? Why do CVs from 2010 applicants still exist in accessible systems? Without data inventory and retention enforcement, administrative systems become breach liability.
If your business runs on databases, you probably have similar records—customer data, credentials, financial information. Do you know what's actually in yours?
What does attribution look like the morning after?
International organizations operate under special legal frameworks. The Council of Europe has headquarters in France but operates across 46 member states. Staff come from across Europe. Notification obligations span multiple jurisdictions.
Beyond legal obligations, the reputational impact matters. An organization focused on human rights and rule of law has suffered a breach exposing the personal data of staff who work on those issues. The irony isn't lost on adversaries or observers.
What would have changed the outcome?
Knowing what 75 years of HR operations had accumulated—and implementing retention limits on administrative data.
429,000 files is decades of accumulation. Aggressive retention policies—deleting payslips after legal requirements expire, purging old applicant CVs, archiving historical personnel files offline—would have dramatically reduced what attackers could access. HR data has a shelf life. Treat it that way.
Council of Europe found out the hard way.
Your team could spend the next 6 months rebuilding systems, notifying customers, and answering legal questions. Or you could spend 24 hours finding out what's actually at risk.