A single unauthenticated request over HTTP is all it took. In the span of two weeks in June 2026, the data-theft crew known as ShinyHunters turned an obscure corner of enterprise software – Oracle’s PeopleSoft human-resources and finance platform – into the year’s most damaging breach campaign. By exploiting a critical zero-day now tracked as CVE-2026-35273, the group claims to have compromised more than 300 PeopleSoft instances across over 100 organizations, with universities bearing the brunt. The ShinyHunters Oracle PeopleSoft breach is more than another data leak; it is a flashing warning that internet-exposed enterprise resource planning (ERP) software has become a primary, industrialized target for organized cybercrime.
The campaign reads like a greatest-hits reel of modern extortion: a CVSS 9.8 remote-code-execution flaw, automated mass scanning, a taunting ransom note dropped on production servers, and parallel “pay or leak” threats against household names including Eastman Kodak, Amazon’s One Medical and the Council of Europe. This analysis breaks down exactly what happened, how CVE-2026-35273 works, who ShinyHunters is, how this Oracle PeopleSoft zero-day compares to the Cl0p attacks on Oracle E-Business Suite just eight months earlier, and what the market and defenders should expect for the rest of 2026.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
ShinyHunters Exploits Oracle PeopleSoft Zero-Day to Breach 100+ Organizations
Oracle published its out-of-band security alert for CVE-2026-35273 on June 10, 2026. According to Arctic Wolf’s incident analysis, ShinyHunters had been quietly exploiting the flaw since at least May 27, 2026, scanning the public internet for vulnerable PeopleSoft deployments and compromising them at scale – a window of active exploitation that Google’s Threat Intelligence Group (GTIG) and Mandiant independently confirmed ran from May 27 through June 9, 2026. By June 9, the group claimed a tally of more than 300 vulnerable instances across 100-plus organizations, a figure risk-intelligence firm BlackKite corroborated as still standing as of the June 10 alert – and one The Register independently reported that same month, citing the group’s own claims of 100-plus victim organizations tied to more than 300 compromised PeopleSoft instances.
What separates this from a typical breach is the industrialization. Rather than hand-crafting an exploit for one high-value target, ShinyHunters deployed automated attack scripts capable of scanning and compromising PeopleSoft environments en masse, as documented by ERP-security vendor Pathlock. The threat-intelligence team at Mandiant identified more than 100 exposed endpoints tied to the campaign, and a separate technical breakdown found that universities accounted for roughly two-thirds of confirmed victims – about 67 of the 100-plus organizations hit. On compromised servers, responders found a ransom note bluntly named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT, alongside five distinct Windows variants and one Linux variant of the MeshCentral remote-monitoring tool that the group repurposed for persistent access – the calling card of a crew that no longer bothers with encryption malware at all.
It is worth stressing what is confirmed versus claimed. ShinyHunters’ figure of 100-plus victim organizations was confirmed to BleepingComputer and TechCrunch by a member of the group itself, but those self-reported numbers have not been independently verified. As of this writing, only one victim has publicly acknowledged the incident – and that single confirmation is alarming enough on its own.
Inside CVE-2026-35273: A CVSS 9.8 Unauthenticated RCE
CVE-2026-35273 lives in the Updates Environment Management component – more specifically the PeopleSoft Environment Management Hub (EMHub) – of Oracle PeopleSoft PeopleTools, the framework that underpins PeopleSoft applications. Security firm FieldEffect confirmed on June 11, 2026 that ShinyHunters was targeting EMHub specifically rather than PeopleSoft’s broader attack surface, a finding Google Cloud’s Mandiant team corroborated the same day. Per the official Oracle Security Alert and the National Vulnerability Database entry, the flaw carries a CVSS 3.1 base score of 9.8 (Critical), and Oracle’s own June 2026 advisory confirms PeopleTools versions 8.61 and 8.62 as the affected releases. It is remotely exploitable without authentication – no username, no password – requires no user interaction, and has low attack complexity. In plain terms: any attacker who can reach a vulnerable instance over HTTP can run arbitrary code on it.
The affected versions are PeopleTools 8.61 and 8.62. Oracle credited the Trend ZDI / Trend Research program with reporting the vulnerability, and on June 10, 2026 shipped fixes as part of Critical Patch Update CPU187, released alongside the out-of-band alert rather than held for the next quarterly cycle – a strong signal of how urgent the company considered the threat, according to an analysis by the Cloud Security Alliance and confirmed independently by incident-response firm Moxfive. The combination of an unauthenticated vector and the sensitive data PeopleSoft typically holds (payroll, HR, financial and student records) is precisely why this CVE jumped to the top of every enterprise patch queue overnight.
How the “Gadget Chain” Works
Security researchers describe ShinyHunters’ technique as a “gadget chain” – a sequence that combines older, already-known PeopleSoft weaknesses with the previously undisclosed CVE-2026-35273 zero-day. Chaining lets attackers stitch together small footholds into full remote code execution, and it means that organizations which patched piecemeal in the past may still be exposed if they missed any link in the chain. The lesson for defenders is uncomfortable: a single up-to-date CVE patch is not the same as a hardened, fully-patched PeopleSoft estate.
The Scale: 300+ Instances, Education Hit Hardest
The education sector’s prominence is no accident. Universities run sprawling, decentralized PeopleSoft deployments – often one per campus, department or affiliated institution – and frequently leave administrative portals reachable from the open internet to serve remote students and staff. That makes higher education a target-rich environment for automated mass exploitation. The most prominent confirmed victim illustrates the stakes: the University of Nottingham acknowledged a cybersecurity incident after ShinyHunters published more than 40 GB of stolen data covering 454,600 current and former student records – a figure risk-intelligence firm BlackKite tracked as the campaign’s largest single education-sector exposure as of June 2026, and which The Register first described in June 2026 as “hundreds of thousands” of exposed records – spanning campuses in the United Kingdom, Malaysia and China.
Below is a timeline of the campaign’s key moments, assembled from vendor advisories and reporting.
| Date (2026) | Event |
|---|---|
| May 27 | Earliest observed exploitation of PeopleSoft instances (per Mandiant / Arctic Wolf) |
| June 9 | ShinyHunters claims 300+ instances across 100+ organizations |
| June 10 | Oracle publishes out-of-band alert for CVE-2026-35273; vendors release detection guidance |
| June 11 | First public victim confirms incident: 40+ GB, ~500,000 student records (UK / Malaysia / China) |
| June 15 | Eastman Kodak listed on the leak site; 2.2M+ records threatened |
| Mid-June | Amazon One Medical (8.8 TB) and Council of Europe (429,000+ documents) claimed |
| June 18 | Kodak extortion deadline passes |
Who Are ShinyHunters? From Snowflake to Salesforce to Oracle
ShinyHunters is a financially motivated data-theft and extortion group, tracked under aliases including Bling Libra, UNC6040 and UNC6240. Mandiant also follows ShinyHunters-affiliated voice-phishing (vishing) activity under clusters such as UNC6240 and UNC6661. The group’s signature is “pay or leak”: steal large volumes of data, then pressure victims by threatening publication on a dark-web leak site and Telegram channel.
This is not a newcomer. ShinyHunters has been linked to some of the highest-profile data thefts of the past two years. The group was associated with the 2024 wave of Snowflake-related breaches driven by stolen credentials and vishing, as well as data theft tied to Ticketmaster and AT&T that same year, and a sprawling Salesforce credential-theft campaign that, per Atlas Analysis, began with reconnaissance scanning of Salesforce Experience Cloud instances as early as September 2025, ramped into automated mass exploitation by early 2026, and culminated in a March 14, 2026 threat to publish the stolen Salesforce data. Researchers also place ShinyHunters in the same operational orbit as Scattered Spider – the two crews jointly published a proof-of-concept exploit for the earlier Oracle E-Business Suite flaw – and the loose, overlapping collective is sometimes branded in the press as “Scattered LAPSUS$ Hunters.”
The throughline is consistent: ShinyHunters favors identity-platform and SaaS compromise, large-scale exfiltration, and public-pressure extortion over destructive malware. The Oracle PeopleSoft campaign simply adds a fourth pillar – direct exploitation of an internet-facing ERP zero-day – to an already formidable playbook.
Kodak, Amazon One Medical and the Council of Europe: Parallel Extortion Tracks
One of the most striking features of the June 2026 campaign is that ShinyHunters ran multiple extortion tracks simultaneously rather than working through victims sequentially. Eastman Kodak confirmed that an unauthorized third party briefly accessed a limited amount of company data after the group listed Kodak on its leak site on June 15, threatening to publish more than 2.2 million records of customer personally identifiable information and internal corporate files by a June 18 deadline. Separately, ShinyHunters claimed to have exfiltrated 8.8 terabytes of data from Amazon’s One Medical healthcare platform and more than 429,000 documents from the Council of Europe, including payroll, HR and medical files.
Aggregated across the campaign, ShinyHunters has claimed more than 42 million records. That figure should be treated with skepticism – but it is not pure bluster. The breach-notification service Have I Been Pwned independently verified roughly 4.9 million unique email addresses tied to the group’s data exposure, a sobering floor under the headline number. The table below summarizes the major claims and their verification status.
| Target | Sector | Data Claimed | Status |
|---|---|---|---|
| 100+ organizations | Mostly higher education | 300+ PeopleSoft instances | Self-reported; partly verified |
| Confirmed university | Education | 40+ GB, ~500,000 student records | Confirmed by victim |
| Eastman Kodak | Imaging / manufacturing | 2.2M+ records (PII + corporate) | Access confirmed by Kodak |
| Amazon One Medical | Healthcare | 8.8 TB | Claimed (unverified) |
| Council of Europe | Government / IGO | 429,000+ documents | Claimed (unverified) |
| Campaign aggregate | – | 42M+ records claimed | 4.9M emails verified by HIBP |
The June extortion surge was not limited to ShinyHunters. A separate, smaller crew calling itself Shadowbyt3$ claimed an unrelated breach of Nintendo employee survey data held by third-party platform TinyPulse, underscoring just how crowded the data-theft-extortion ecosystem had become by mid-2026. That crowding makes ShinyHunters’ own timeline notable by comparison: Mandiant’s telemetry pins the PeopleSoft campaign’s active-exploitation window at May 27 through June 9, 2026, a roughly two-week sprint that produced most of the group’s claimed victim list before Oracle’s alert even shipped.
Data-Theft Extortion vs. Traditional Ransomware
The ShinyHunters campaign exemplifies a structural shift that has been underway for several years: the move away from encryption-based ransomware toward pure data-theft extortion. Classic ransomware encrypts a victim’s files and demands payment for the decryption key, locking systems and triggering visible downtime. Data-theft extortion skips the encryption payload entirely. Attackers steal sensitive data, then threaten to publish it unless paid.
The model is attractive to criminals for several reasons. It is faster – there is no need to deploy and detonate encryptors across an environment. It is stealthier, since exfiltration can masquerade as ordinary traffic and avoids the loud, obvious symptom of locked machines. And it sidesteps the strongest defense against encryption ransomware – good backups – because restoring from backup does nothing to un-leak data that is already in the attacker’s hands. The pressure shifts from operational disruption to reputational and regulatory damage: GDPR fines, breach-notification costs, lawsuits and brand harm. For PeopleSoft victims sitting on payroll, HR and student records, that exposure is severe.
This is also why the campaign is so hard to deter. There is no system to “restore” and no clean technical recovery that erases the leverage. Once the data is gone, the only questions are whether the victim pays and whether the regulators come calling.
The Second Oracle ERP Zero-Day in Eight Months
Context matters here, and the context is damning for Oracle’s ERP attack surface. CVE-2026-35273 is the second critical, actively-exploited Oracle ERP zero-day in roughly eight months. In the second half of 2025, the Cl0p ransomware group (tracked by CrowdStrike as GRACEFUL SPIDER) exploited CVE-2025-61882, a CVSS 9.8 unauthenticated remote-code-execution flaw in Oracle E-Business Suite. According to CrowdStrike’s analysis, the first known exploitation occurred around August 9, 2025, and Oracle published its emergency, out-of-band security alert on October 4, 2025.
The parallels are uncanny: two different ERP product lines, two different threat groups, the same maximum-severity unauthenticated RCE pattern, the same data-theft-extortion endgame, and the same out-of-band patch response from Oracle. The table below puts the two side by side.
| Attribute | CVE-2026-35273 | CVE-2025-61882 |
|---|---|---|
| Product | PeopleSoft PeopleTools 8.61 / 8.62 | E-Business Suite 12.2.3â12.2.14 |
| Component | Updates Environment Management | BI Publisher / Concurrent Processing |
| CVSS 3.1 | 9.8 (Critical) | 9.8 (Critical) |
| Vector | Unauthenticated RCE over HTTP | Unauthenticated RCE |
| Threat actor | ShinyHunters (Bling Libra) | Cl0p (GRACEFUL SPIDER) |
| First exploited | May 27, 2026 | ~Aug 9, 2025 |
| Oracle alert | June 10, 2026 (out-of-band) | Oct 4, 2025 (out-of-band) |
| Endgame | Data-theft extortion | Data-theft extortion |
What Oracle, Mandiant and Security Vendors Are Saying
The picture painted by named organizations tracking this campaign is consistent. Oracle’s out-of-band alert frames CVE-2026-35273 as a remotely exploitable, unauthenticated flaw that may result in remote code execution, and directs customers to its Patch Availability Document for fixes. Arctic Wolf strongly recommends upgrading affected PeopleTools 8.61 and 8.62 deployments to the latest fixed version immediately, citing confirmed active exploitation and the sensitivity of PeopleSoft data.
Mandiant’s telemetry identified more than 100 exposed endpoints tied to the campaign and confirmed that the flaw requires no login and no user click – only HTTP access. Pathlock’s teardown emphasizes the industrialized nature of the attack: automated scripts scanning and compromising PeopleSoft environments at scale, evidence that ERP applications are no longer too obscure to attract organized cybercrime. CISA added CVE-2026-35273 to its Known Exploited Vulnerabilities catalog on June 12, 2026, as incident-response firm Moxfive noted, giving federal civilian agencies a remediation deadline of June 15, 2026 – one of the fastest KEV turnarounds of the year. And during the comparable 2025 Oracle EBS campaign, CrowdStrike released a Falcon Next-Gen SIEM detection-rule template within weeks – a pattern of rapid detection-content publishing that defenders should expect to repeat for PeopleSoft. The consensus across vendors is unambiguous: patch now, assume exposure, and hunt for indicators of compromise.
Detecting and Mitigating the Oracle PeopleSoft Exploit
For teams running PeopleSoft, the immediate priorities are patching CVE-2026-35273, removing internet exposure where possible, and hunting for evidence of compromise. The defensive snippet below illustrates two quick checks: searching hosts for the campaign’s distinctive ransom-note filename, and confirming whether a PeopleSoft Internet Architecture portal is reachable from the public internet.
# Defensive only: hunt for the ShinyHunters ransom note across PeopleSoft hosts
find / -name "README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT" 2>/dev/null
# Check whether a PeopleSoft (PIA) portal is internet-exposed
curl -s -o /dev/null -w "HTTP %{http_code}n"
"https://your-peoplesoft-host/psp/ps/?cmd=login"
# PeopleSoft app servers should never spawn shells; review web-tier
# process trees for anomalous child processes (sh, bash, cmd.exe)Beyond patching, the standard ERP-hardening checklist applies with new urgency: place PeopleSoft behind a VPN or zero-trust gateway rather than exposing it directly; enforce web-application-firewall rules around the PeopleTools portal; monitor for the gadget-chain indicators published by Arctic Wolf and Oracle; and rotate any credentials or tokens that may have been accessible from a compromised instance. Because ShinyHunters favors data theft over encryption, robust egress monitoring and data-loss-prevention controls matter as much as backups.
Market Impact: ERP Security and the Cost of a Breach
No public victim has reported a material stock move directly attributable to the PeopleSoft campaign as of late June 2026, and ShinyHunters’ aggregate figures remain partly unverified. But the market signal is still loud. Two maximum-severity Oracle ERP zero-days inside eight months – each weaponized by a major extortion crew within days of discovery – reframes ERP as a board-level security risk rather than a back-office concern. Expect renewed scrutiny of Oracle’s patch cadence and out-of-band response process, and expect ERP-specific security tooling (configuration monitoring, exposure management, and ERP-aware detection content from vendors like CrowdStrike, Arctic Wolf and Pathlock) to see accelerated demand.
The higher-education concentration carries its own budget shock. Universities operate on thin IT-security margins, and a breach exposing hundreds of thousands of student records triggers cascading costs: breach notification, credit-monitoring offers, regulatory inquiries under GDPR and US state laws, and potential class-action exposure. For institutions in the UK, EU and Asia caught in the cross-border data spill, the regulatory math is especially punishing.
Historical Context: The Industrialization of ERP Attacks
For years, ERP platforms enjoyed a kind of security through obscurity. PeopleSoft, SAP and Oracle E-Business Suite are complex, customized and operated by specialist teams – a poor fit for the spray-and-pray tactics of commodity ransomware. The 2025â2026 Oracle campaigns demolish that assumption. Cl0p’s mastery of mass-exploitation playbooks, honed on file-transfer tools like MOVEit and GoAnywhere, has now been pointed squarely at enterprise applications. ShinyHunters’ automated PeopleSoft scanning is the same evolution applied to a different product line.
The strategic logic is simple: ERP systems are where the crown-jewel data lives. Payroll, taxpayer identifiers, banking details, health records and student information all flow through these platforms. A single unauthenticated RCE against an internet-facing instance hands attackers the most valuable data in the organization in one move. The industrialization of ERP attacks – automated discovery, gadget-chain exploitation and parallel-track extortion – is the defining cybersecurity story of mid-2026, and CVE-2026-35273 is its clearest case study.
5 Predictions for the Rest of 2026
The following forward-looking assessments are this publication’s analysis, not attributed to any named individual:
- CVE-2026-35273 enters CISA’s KEV catalog with a federal remediation deadline. Given confirmed in-the-wild exploitation and CVSS 9.8 severity, US agencies running PeopleSoft will face a mandatory, short-fuse patch order.
- More victims surface through Q3 2026. The 100-plus claim is still mostly self-reported; expect a steady drip of university and enterprise disclosures as breach-notification obligations force confirmations over the summer.
- Oracle faces renewed scrutiny and possible litigation. Two ERP zero-days in eight months will pressure Oracle’s secure-development and patch-cadence reputation, and could invite class actions from affected institutions.
- Pure data-theft extortion keeps displacing encryption ransomware. The ShinyHunters model – no encryptor, backups irrelevant, leak-site leverage – will be copied by more crews chasing faster, stealthier payouts.
- Internet-exposed ERP becomes a board-level metric. Exposure-management vendors will market ERP-specific attack-surface monitoring, and CISOs will be asked, pointedly, how many PeopleSoft and SAP portals their organization exposes to the open internet.
Frequently Asked Questions
What is the ShinyHunters Oracle PeopleSoft breach?
It is a June 2026 mass-exploitation campaign in which the ShinyHunters extortion group abused a critical zero-day, CVE-2026-35273, in Oracle PeopleSoft PeopleTools. The group claims to have compromised more than 300 PeopleSoft instances across 100-plus organizations, with universities hit hardest, and is using stolen data for “pay or leak” extortion.
What is CVE-2026-35273 and how severe is it?
CVE-2026-35273 is an unauthenticated remote-code-execution flaw in the Updates Environment Management component of PeopleTools 8.61 and 8.62. It carries a CVSS 3.1 score of 9.8 (Critical), needs no authentication or user interaction, and is exploitable over HTTP. Oracle issued an out-of-band security alert on June 10, 2026.
Who are ShinyHunters?
ShinyHunters is a financially motivated data-theft and extortion group also tracked as Bling Libra, UNC6040 and UNC6240. It has been linked to major 2024â2025 breaches involving Snowflake-related credential theft, Ticketmaster, AT&T and Salesforce, and operates in the same orbit as Scattered Spider.
Is the Oracle PeopleSoft attack the same as the 2025 Cl0p campaign?
No, but they are closely parallel. The 2025 campaign by Cl0p exploited CVE-2025-61882, a separate CVSS 9.8 unauthenticated RCE in Oracle E-Business Suite, starting around August 2025. The 2026 PeopleSoft campaign by ShinyHunters uses CVE-2026-35273. Both are maximum-severity ERP zero-days ending in data-theft extortion.
How many records were actually stolen?
ShinyHunters claims more than 42 million records across the campaign, but those figures are largely self-reported and unverified. The Have I Been Pwned service independently verified roughly 4.9 million unique email addresses, and the confirmed University of Nottingham breach accounted for 454,600 student records and 40+ GB of data, per BlackKite’s June 2026 tracking.
How can organizations protect their PeopleSoft systems?
Apply Oracle’s patch for CVE-2026-35273 immediately via the Patch Availability Document, remove direct internet exposure of PeopleSoft portals, deploy web-application-firewall and egress-monitoring controls, hunt for the ransom-note indicator and gadget-chain artifacts, and rotate any credentials accessible from potentially compromised instances.
Why is the education sector the main target?
Universities run large, decentralized PeopleSoft deployments and often expose administrative portals to the internet for remote students and staff. That broad, internet-facing footprint, combined with constrained security budgets, makes higher education ideal for the automated mass exploitation ShinyHunters used in this campaign.
