ShinyHunters Exploits Oracle PeopleSoft Zero-Day to Extort Organizations
Active Exploitation · 2 sources · Updated 2mo ago · First seen Sep 12, 2026
ShinyHunters reportedly exploited a critical zero-day vulnerability in Oracle PeopleSoft during May and early June 2026, compromising about 300 PeopleSoft instances at roughly 100 organizations worldwide. The Council of Europe was among the alleged victims; attackers targeted ERP management and configuration layers to steal employee and student personal data, payroll, tax, financial, health, immigration, and passport records. The Council reportedly declined to negotiate or pay.
Reported extortion demands ranged from $400,000 to $2.3 million per victim. The incident highlights the exposure created by cloud and SaaS supply-chain dependencies and the need for rapid risk-based remediation, Zero Trust and identity controls, dependency mapping, isolated immutable backups, and regularly tested cyber-recovery plans.
