Contact us Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

coe.int

coe.int

Discovered 2026-06-14 00:54 UTC
Est. attack date 2026-06-13
Country FR

Description:

Over 297 GB of Council of Europe HR and payroll data (429,000+ files) was compromised across the Secretariat, Directorate of Human Resources, Parliamentary Assembly, EDQM, permanent and temporary staff, interpreters, conference services, language booth units, and payroll administration, including 409,000+ payslips for 10,000+ staff from 2011 to 2026, 14,000+ CVs and 3,700+ in-house personnel files, 10,700+ per-employee document stores, contract and purchase order records, mission travel overpayments, interpreter scheduling and 2026 salary scales, Blue List rosters, absence and illness reports, bank account and URSSAF payroll data, performance evaluations, and payroll exports, covering full names, employee IDs, home addresses, phone numbers, dates of birth, salaries, bank details, tax and social security information, medical and absence records, mission references, and other internal institutional data. This is a final warning to reach out by 16 June 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 14 June 2026 | Warning: FINAL WARNING PAY OR LEAK

Infostealer activity detected by HudsonRock

Compromised Employees: 17

Compromised Users: 1611

Third Party Employee Credentials: 18


External Attack Surface: 116


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • jean-francois.bilgercoe.int
  • marc.ulrichcoe.int
MX Records
  • neon.coe.int.
  • cuivre.coe.int.
TXT Records
  • v=spf1 ip4:193.164.229.13/32 ip4:193.164.229.94/32 ip4:193.164.229.99/32 include:spf.mailjet.com include:_spf-amicale.coe.int include:email.prnewswire.com include:spf.avetica.net include:amazonses.com include:spf.sendinblue.com ~all
  • ZOOM_verify_OvKVCROhdlLIUBbSjHvmmX
  • europeanyear2025=44bb35eb13b49e4ab024ae642cdf6346
  • ca3-53674554e17d487a80f4decc91a66aef
  • ca3-a80a651e3dcd45e697ce3f655200c2ab
  • ca3-c21bd1193360474d941d5b6920c2ce24
  • adobe-idp-site-verification=a1e134027481990b52e297d67565fe993394f4279160ba0ac3756620e0ff54b2
  • 7722522b-5ad4-4f9a-b47b-bda2a0cd4789
  • brevo-code:80b22ac3609c319be8fc8ee1b1b3e9a3
  • cisco-ci-domain-verification=49aecbb10502dad93bec3f0ff803feae39508bd59cf9fcc45582d1bd2a3faccd
  • google-site-verification=_NSR8peqvwCmjug3hAT5l3nfETCo4u7woghRUrNv3Y0
  • brevo-code:bded15d056dbe2190eace2d1e0e3a2c6
  • miro-verification=c74a41d9d6389e6477cb51e1947a331ba9dfc22e
  • 7uYKdIHW9tLt69yQHSDT9mQqKMH8hedgocFoXal5R5ThpU7qj1ap8jADr1F+dYgYPR8PIDI0lmiaYoMjSxeQtw==
Cloud / SaaS Services Detected
Adobe Amazon SES/WorkMail Miro Cisco Mailjet Sendinblue Zoom