The prolific ShinyHunters cybercrime group has launched a sweeping data theft and extortion campaign against Oracle PeopleSoft servers, claiming to have compromised more than 300 instances across over 100 organizations. The group is leveraging a “gadget chain” of both old and zero-day vulnerabilities to breach both cloud and on-premises PeopleSoft installations, with the education sector hit especially hard.
The University of Nottingham has been confirmed as a high-profile victim, with approximately 455,000 unique records leaked including names, email and postal addresses, phone numbers, passport numbers, academic enrollment data, and financial information. The leaked data — over 40GB — spans the university’s campuses in the UK, Malaysia, and China. The breach was detected on June 9, and the university has taken affected systems offline while launching a forensic investigation.
In a brazen twist, ShinyHunters reportedly attempted to breach an FBI portal running PeopleSoft to publish a statement, though that effort was unsuccessful. Oracle has not yet issued a public statement or confirmed any zero-day vulnerabilities related to the campaign.
Sources
- BleepingComputer — Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks
- SecurityWeek — University of Nottingham confirms breach
- Have I Been Pwned — University of Nottingham
Commentary
ShinyHunters continue to be one of the most aggressive data extortion groups in operation. The scale of this PeopleSoft campaign is alarming — 300+ instances suggests either a reliable zero-day chain or widespread failure to patch known vulnerabilities. Oracle’s silence is deafening. If there are confirmed zero-days being actively exploited at this scale, the vendor owes its customers immediate transparency and mitigation guidance.
The education sector’s vulnerability here is predictable but no less concerning. Universities are typically under-resourced for cybersecurity while managing massive, sensitive datasets. The Nottingham breach exposing passport numbers and financial data across three countries makes this an international incident with regulatory implications under GDPR, Malaysia’s PDPA, and China’s PIPL simultaneously. It’s a compliance nightmare on top of a security disaster.