The University of Nottingham confirmed a cybersecurity incident and notified affected students and alumni after its data was published on the ShinyHunters data leak site, following an Oracle PeopleSoft server breach in 2026. This incident highlights how cybercriminals are exploiting critical vulnerabilities. Oracle released an out-of-band update for PeopleSoft to address CVE-2026-35273, a zero-day vulnerability, indicating active exploitation.
Oracle's enterprise software is widely trusted for critical operations, but a zero-day allowed widespread data theft before a fix was released. PeopleSoft servers are being targeted in data theft attacks, impacting numerous organizations globally, according to BleepingComputer.
Organizations using PeopleSoft are at immediate risk and must prioritize patching, with potential long-term implications for data security and Oracle's reputation. This situation underscores the urgent need for robust security measures against sophisticated threat actors.
Who is Behind the Attacks and What's the Scale?
- The ShinyHunters gang is exploiting vulnerabilities to target Oracle PeopleSoft servers, according to SC Media.
- The ShinyHunters extortion group claims to have stolen data from hundreds of Oracle PeopleSoft environments, as reported by Techzine Global.
- Many of the compromised organizations are universities, a finding detailed by TechCrunch.
The involvement of a known extortion group and the broad claim of hundreds of compromised environments suggests a highly organized and impactful campaign targeting specific sectors. While ShinyHunters claims data from hundreds of Oracle PeopleSoft environments, only the University of Nottingham has publicly confirmed a cybersecurity incident related to PeopleSoft exploitation, suggesting many affected organizations might still be unaware or are choosing not to disclose the full extent of their compromise.
