A critical zero-day vulnerability. Over 100 compromised organizations. Hundreds of thousands of students' personal records published on a dark web leak site. The latest campaign from the ShinyHunters extortion group is one of the most alarming cybersecurity incidents to hit higher education in years — and if your institution runs Oracle PeopleSoft, you may already be affected.

Here's a complete breakdown of what happened, how the attack worked, and — most importantly — what your organization must do right now.

Who Are ShinyHunters?

ShinyHunters is a prolific, financially motivated cybercriminal group, first emerging in 2020 and known for high-profile data breaches, extortion, and the sale of stolen data on underground forums and dedicated leak sites.

But their appetite for targeting educational institutions is far from new.

ShinyHunters has focused its extortion operations on organizations that hold large volumes of potentially sensitive personal data, like schools and universities. The group previously leaked data stolen from Harvard and the University of Pennsylvania as part of earlier shakedown efforts targeting higher education.

Earlier in 2026, the group struck the Canvas learning management platform.

That hack is considered the largest educational security breach on record due to its unprecedented global scale, affecting 8,809 universities, educational ministries, and other institutions worldwide. The breach had particularly significant implications in the United States, where Canvas is used by 41% of higher education institutions. ShinyHunters claimed to have stolen 3.65 terabytes of data from approximately 275 million users, including private messages exchanged between students and teachers.

The Oracle PeopleSoft campaign, then, is not an isolated incident — it is the latest chapter in a deliberate, ongoing assault on higher education.

The Oracle PeopleSoft Zero-Day: CVE-2026-35273

Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. The activity was observed between May 27, 2026, and June 9, 2026, and is consistent with the exploitation of CVE-2026-35273, a critical remote code execution vulnerability with a CVSS score of 9.8 in the Environment Management component.

The ShinyHunters extortion gang exploited a zero-day vulnerability in PeopleTools, PeopleSoft's underlying integrated development environment (IDE) and runtime platform, according to new research from Mandiant and the Google Threat Intelligence Group (GTIG). More specifically, the vulnerability is located in the Environment Management Hub (EMHub), a backend service that tracks and manages agents across PeopleSoft environments.

What makes this flaw particularly dangerous is just how little an attacker needs to exploit it.

The flaw, CVE-2026-35273, is a remote code execution bug in PeopleSoft Enterprise PeopleTools rated 9.8 out of 10. It needs no login and no user interaction — just network access over HTTP — to take over the server.

Critically,

because this activity predates Oracle's June 10, 2026 advisory, the vulnerability was exploited as a zero-day.

Organizations had no vendor-sanctioned mitigation available while the attacks were actively in progress.

How the Attack Unfolded

The ShinyHunters campaign was notable not just for the severity of the vulnerability, but for the precision and scale with which it was deployed.

Rather than targeting a single organization with a tailored exploit, ShinyHunters deployed automated attack scripts capable of scanning and compromising PeopleSoft environments at scale, demonstrating that ERP applications are no longer too obscure or complex to attract organized, industrialized cybercrime.

Once inside a system, the attackers used a particularly stealthy technique:

instead of a direct database exploit, they operated entirely inside PeopleSoft's application logic, using legitimate APIs to access and extract records. This means standard database security monitors never noticed anything wrong.

A script named [victim]_fanout.sh spread over SSH by spraying a hardcoded list of usernames and passwords against internal hosts pulled from /etc/hosts, then dropped a marker file named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT into PeopleSoft directories. The command history shows the data compressed with zstd and an outbound SSH connection to the server hosting the public mirror of the ShinyHunters leak site.

Who Was Affected — and What Data Was Stolen?

The scale of the breach is staggering.

Mandiant notified more than 100 organizations whose IP addresses matched vulnerable endpoints. Sixty-eight percent were in higher education, most of them in the United States. Some blocked the activity; others were compromised and had data posted to the leak site.

The University of Nottingham is one of the first confirmed victims. Have I Been Pwned has counted about 455,000 unique email addresses in the leaked set, covering current students and alumni, with names, addresses, phone numbers, passport numbers, and details on ethnicity and disabilities.

The data claimed stolen was deeply sensitive.

The post claimed compromised data included "over 40 GB of billing and payment records, credit card and payment details, student finance data, and campus portal exports."

The extortion approach itself was calculated.

Rather than selling stolen data on dark web forums, ShinyHunters contacted university leadership directly with proof of access and demanded payment to delete the records and refrain from public disclosure.

On June 9, ShinyHunters began publishing stolen archives to their dark web data leak site, threatening to release massive troves of sensitive student finance data, billing records, and personal identification details unless ransoms were paid.

Why Higher Education Is Especially Vulnerable

Universities are not just targets of opportunity — they are strategic targets for groups like ShinyHunters.

PeopleSoft is an enterprise resource planning (ERP) application suite used for things like payroll, supply chain management, human resources (HR), and student administration. It's primarily oriented to large businesses and organizations, such as government entities and higher education institutions.

Threat actors prioritize targets based on the potential value of exfiltrated data and the likelihood of ransom payment. Entities with large volumes of personally identifiable information (PII), financial records, or intellectual property are especially attractive.

Higher education institutions also face structural security challenges: decentralised IT environments, legacy systems, constrained budgets, and large numbers of internet-facing services.

The hidden danger in PeopleSoft estates is not usually the server everyone knows about; it is the old endpoint still reachable because a workflow, integration, or department portal would break if someone removed it.

This tactic is similar to other major supply-chain software compromises observed in the past, like the MOVEit breaches

— a reminder that attackers will keep returning to high-value, under-defended sectors until the risk calculus changes.

Oracle's Response and the Patching Window

Oracle released an out-of-band security alert on June 10, 2026, and published emergency mitigation guidance alongside it. This is not a routine quarterly update — it is an unscheduled advisory triggered by active exploitation.

As of the time of writing, Oracle has not released a full patch for CVE-2026-35273. Customers must apply the mitigations published in the advisory — accessible via My Oracle Support — and await further guidance for a permanent fix.

Only versions 8.61 and 8.62 under Premier or Extended Support are eligible for patches; unsupported versions remain vulnerable and should be decommissioned or isolated.

This means organisations running older, out-of-support PeopleSoft environments are in a particularly precarious position with no direct patch path available.

Practical Tips: What Your Organization Must Do Right Now

If your institution or organization runs Oracle PeopleSoft, treat the following steps as an immediate operational priority:

Oracle considers implementation of the recommended mitigations to be a high-priority risk reduction measure and strongly recommends immediate action to address the identified exposure.

Access guidance through My Oracle Support now.

The first operational step is inventory. Confirm where PeopleTools 8.61 and 8.62 exist, which instances expose PeopleSoft services, which network zones can reach them, and which environments have copies of production data.

Don't forget staging, DR, and development environments.

If you run PeopleSoft with the Environment Management Hub reachable from outside, that is your exposure, and the immediate move is to lock those endpoints down.

Given that exploitation occurred as early as May 27, 2026, Rapid7 strongly recommends investigating for signs of compromise even after patching,

using the indicators of compromise outlined by Mandiant and GTIG.

Check your PeopleSoft logs for connections from the following attacker-controlled IPs: 142.11.200.186–190 and 108.174.202.99.

Monitor outbound SMB traffic (TCP port 445) from PeopleSoft servers to untrusted external destinations.

Unusual outbound connections are a key indicator of post-exploitation activity.

Organizations on older, unsupported PeopleSoft versions should assume vulnerability and treat the situation as a critical emergency.

Conclusion: The Threat to Higher Education Is Accelerating

The ShinyHunters Oracle PeopleSoft campaign is a watershed moment for cybersecurity in higher education.

The campaign demonstrates the increasing sophistication of threat actors in leveraging zero-day vulnerabilities against critical enterprise applications and highlights the urgent need for robust vulnerability management and incident response capabilities.

This is no longer a question of whether universities will be targeted — it is a question of whether they will be ready when they are.

The window for action is narrow. Oracle has published emergency mitigations, but

this campaign is still active, with ShinyHunters sending extortions as recently as mid-June, according to Google's Charles Carmakal.

More victim disclosures are almost certainly coming.

Is your institution's PeopleSoft environment protected? Don't wait for an extortion email to find out. Contact your IT security team today, review Oracle's June 10 advisory, and begin your incident investigation immediately. If you need expert guidance on assessing your exposure or responding to a potential compromise, reach out to a qualified cybersecurity partner — the cost of prevention is a fraction of what a breach will demand.