Loading story…
ShinyHunters reportedly exploited a critical zero-day vulnerability in Oracle PeopleSoft during May and early June 2026, compromising about 300 PeopleSoft instances at roughly 100 organizations worldwide. The Council of Europe was among the alleged victims; attackers targeted ERP management and configuration layers to steal employee and student personal data, payroll, tax, financial, health, immigration, and passport records. The Council reportedly declined to negotiate or pay.
Reported extortion demands ranged from $400,000 to $2.3 million per victim. The incident highlights the exposure created by cloud and SaaS supply-chain dependencies and the need for rapid risk-based remediation, Zero Trust and identity controls, dependency mapping, isolated immutable backups, and regularly tested cyber-recovery plans.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
In May and early June 2026, ShinyHunters reportedly exploited a critical Oracle PeopleSoft zero-day, targeting ERP management and configuration layers to steal data and extort victims. The campaign reportedly affected about 100 organizations and approximately 300 PeopleSoft instances worldwide, including the Council of Europe; stolen records included personal, payroll, tax, financial, health, immigration, and passport data.
The Council of Europe, among the organizations reportedly affected by the PeopleSoft campaign, refused to negotiate with or pay the extortionists. Reported demands ranged from $400,000 to $2.3 million per victim and were often requested in Bitcoin.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ShinyHunters has claimed a broad intrusion campaign against Oracle PeopleSoft servers, saying it compromised roughly 300 instances across more than 100 organizations, with universities and other education-sector entities appearing to be the primary victims. The group told reporters it exfiltrated sensitive student and administrative records, including applicant, financial aid, immigration, health, and contact data, and identified Nottingham University as one victim; the university acknowledged a cybersecurity incident. One member of the group also said an attempted breach of an FBI PeopleSoft server was intended to post a denial of the gang’s involvement in recent swatting incidents, but that effort allegedly failed. Reporting indicates the attacks are tied to data theft and extortion activity and may involve a gadget chain using older flaws alongside a possible zero-day, with impact varying by PeopleSoft configuration. Independent research found exposed directories containing tooling linked to the campaign, including MeshCentral agents, a defacement script, a credential-spraying tool, and infrastructure associated through TLS certificates with `azurenetfiles[.]net`. Investigators also observed a shell script that parsed `/etc/hosts`, attempted SSH access with common PeopleSoft and Oracle administrative accounts, and dropped a ransom note named `README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT` on compromised internal PeopleSoft servers, while Oracle had not publicly commented on the allegations at the time of reporting.
Jul 3, 2026
ShinyHunters publicly leaked data from **Moody Bible Institute** after a "pay or leak" extortion attempt, exposing more than **2.3 million unique email addresses** along with names, physical addresses, phone numbers, dates of birth, and other personal details tied to donors, supporters, students, and alumni. Moody said it brought in internal and external cybersecurity specialists to investigate the breach and respond to the disclosure. The same threat activity has also been linked to attacks on **Oracle PeopleSoft** deployments, with the **National Association of Insurance Commissioners (NAIC)** saying attackers exploited a **zero-day** flaw to gain temporary access to part of its IT environment and steal confidential financial reporting, credit rating agency, and technical data that was later published online. NAIC said the intrusion was part of a broader campaign affecting multiple organizations after ShinyHunters claimed compromises of more than 100 PeopleSoft installations worldwide; the organization said no personally identifiable information or payment account data was involved, remediated affected systems with outside experts, and said the **FBI** was investigating.
Jul 10, 2026
ShinyHunters used an Oracle PeopleSoft exploit to compromise organizations in the education sector, with exposed attacker infrastructure showing staging materials, customized MeshCentral agents, and command history tied to the intrusions. Public reporting identified five sequential attacker-controlled IP addresses serving open Python SimpleHTTP directories on port `8888`, while the operators deployed Windows MeshCentral agents disguised as Microsoft Azure services and configured them to beacon to `wss://azurenetfiles.net:443/agent.ashx`, a domain crafted to resemble Azure NetApp Files branding. Google Threat Intelligence Group said more than 100 exposed organizations were notified, and **68%** of them were in higher education; some victims later had stolen data posted on the ShinyHunters data leak site. The recovered `.bash_history` indicated the attackers installed MeshCentral `v1.1.59` on May 27, 2026, added the `acme-client` npm package to automate Let's Encrypt certificates, used `meshctrl.js` for reconnaissance on compromised systems, examined Oracle PeopleSoft and WebLogic configurations, and then connected outbound over SSH to `176.120.22.24`, identified as the public clearnet mirror of the ShinyHunters leak site.
Jul 15, 2026