The ShinyHunters extortion gang claims to have compromised Oracle PeopleSoft servers across more than 100 organizations, including numerous universities, in an ongoing data theft campaign.
ShinyHunters, a known cybercriminal group, has targeted Oracle PeopleSoft infrastructure in attacks affecting over 100 entities. The gang operates an extortion scheme, typically demanding payment in exchange for not publishing stolen data.
Oracle PeopleSoft is a widely deployed human capital management and enterprise resource planning system used by organizations across sectors including higher education, government, and private industry. The breadth of the breach underscores the risk posed by vulnerabilities in popular enterprise software platforms.
The ShinyHunters group has become increasingly active in recent years, carrying out high-profile attacks against major organizations and publishing data when extortion demands go unmet. Their claims of accessing PeopleSoft systems across universities and other institutions represent a significant security incident, though the specific vulnerabilities exploited remain unclear.
Oracle has not yet issued a public statement regarding the breach. The company typically addresses security issues through its quarterly patch releases and security advisories. Organizations running PeopleSoft should review their systems for signs of compromise and consult Oracle's security guidance.
The timing of the disclosure coincides with Oracle's recent earnings report, which saw shares decline following higher-than-expected capital expenditure figures related to AI infrastructure investments. Investors expressed concerns about the profitability of Oracle's AI business expansion, adding pressure to the company amid broader market uncertainty.
Securityresearchers recommend affected organizations conduct forensic investigations, reset credentials, and review access logs for unauthorized activity. Those targeted by ShinyHunters should also prepare for potential extortion demands and consider reporting the breach to relevant law enforcement agencies and regulators.
Apple plans to move its Hide My Email feature to a different domain in the coming weeks, a change that could reduce the privacy protection the tool currently provides.
A security researcher discovered a critical vulnerability in FIFA's internal systems that could have allowed unauthorized access to modify World Cup television broadcasts. The flaw exposed multiple internal platforms to potential compromise.
Researchers discovered at least 15 malicious plugins on the JetBrains Marketplace designed to steal AI API keys from developers. The plugins bypassed security checks and posed as legitimate development tools.