Council of Europe hacked in ShinyHunters' PeopleSoft heist
Jump to main content
Search
REG AD
CYBER-CRIME
Council of Europe hacked in ShinyHunters' PeopleSoft heist
Joins the ranks of Nottingham Uni and 100 other unnamed victims
Jessica Lyons
Jessica<br>Lyons
Published<br>mon 15 Jun 2026 // 18:44 UTC
ShinyHunters claims to have breached the Council of Europe and stolen more than 297 GB of data after exploiting a zero-day flaw in Oracle PeopleSoft and abusing that hole to hack more than 100 organizations.<br>According to a post on the extortion crew’s data-leak site, the 429,000 pilfered files contain HR and payroll records, payslips, purchase-order records, CVs, and employees’ salary, banking, tax, and medical records.<br>A Council of Europe spokesperson told The Register that it is “currently investigating the matter and assessing the situation,” but declined to comment further.
REG AD
REG AD
A spokesperson for the cybercrime group told us that the Council is yet another victim of the Oracle PeopleSoft heist. Oracle has yet to respond to The Register’s inquiries, and it's unclear if the vulnerability, tracked as CVE-2026-35273, has been patched.<br>ShinyHunters previously told us that the gang exploited the CVE to compromise more than 100 organizations across 300 vulnerable instances, and that these victims included the University of Nottingham.<br>Last week, the crims listed the UK uni on their leak site, then dumped data belonging to around 454,600 current and former students, including personal and academic records.
MORE CONTEXT
ShinyHunters hacked 100+ orgs by exploiting an Oracle PeopleSoft 0-day
Nottingham Uni says student records raided after ShinyHunters claims cyberattack
Oxford Uni student data pwned yet again - this time via career platform breach
Nobody believes the 'criminals and scumbags' who hacked Canvas really deleted stolen student data
Meanwhile, a Google threat report published late last week noted malicious activity, “consistent with the exploitation of CVE-2026-35273,” between May 27 and June 9, and said that its incident responders notified more than 100 global orgs “whose IP addresses correlated with potentially vulnerable endpoints."<br>Most of these are US-based organizations, and 68 percent operated within the higher education sector.<br>This latest heist follows another ShinyHunters intrusion targeting data belonging to university and K-12 students, teachers, and staff.<br>In mid-May, ed-tech giant Instructure said it “reached an agreement” - this is corporate-speak for “paid the ransom demand” - with the data theft and extortion crew after ShinyHunters breached its Canvas digital learning platform and accessed data tied to 275 million students, teachers, and staff.<br>In March, ShinyHunters claimed it stole data from K-12 software provider Infinite Campus as part of a broader wave of Salesforce-related intrusions. The ed tech company did not pay up, and the group subsequently published data they claim was stolen from Infinite Campus, including 137,000 individuals’ email addresses along with names, phone numbers, physical addresses and support tickets.
REG AD
Infinite Campus, in its data breach notification, said that the leaked files largely consisted of “names and contact information for school staff" and that “the majority is directory information commonly found on school websites.” ®
security<br>oracle peoplesoft<br>cyber-crime<br>data breach<br>shinyhunters<br>zero-day
REG AD
Personal tech
Commodore gets into the phone biz with Sailfish-powered retro 'Callback'
Ships sans email, web, or socials, but with plenty of beige plastic
SYSTEMS
There's no such thing as an agentic CPU
AI agents are a general-purpose workload no different from any other
ZTE Day 2026 in Almaty Showcases Innovations Shaping Kazakhstan's Intelligent Telecom Future
PARTNER CONTENT: Empowering Kazakhstan’s "Year of Digitalization and AI" with Next-Gen Connectivity and Supercomputing Solutions
Software
Firefox 152 understands “Sssh!”
As Google continues crippling Chrome ad-blockers, it’s a good time to try Firefox
PAAS AND IAAS
Graviton 5 impresses, but please, for the love of all that's holy, stop calling them 'AI chips'
AWS better at running chip fabs than their mouths
SOFTWARE
Microsoft faces down sueball, capacity problems in series of challenges
Misleading statements about Copilot and AI? Surely not!
MOST POPULAR
security
Feds freaked over Fable 5 after simple 'fix this code' prompt, not jailbreak, says researcher
ON-PREM
Amazon owns up to using 2.5bn gallons of H2O in its bit barns last year
Security
Angry bug hunter with Microsoft beef drops new Windows 0-day
Security
Signal says UK plan to scan devices for nude images 'endangers us all'
security
GitHub nukes 70+ Microsoft repos, breaks CI/CD pipelines, following suspected worm infections
EVENTS
From Prompt to Exploit: How LLMs Are Changing API Attacks
Modern applications are API-driven, interconnected, and often over-permissioned, making...