ShinyHunters exploits Oracle PeopleSoft zero-day to breach 100+ organizations, including University of Nottingham

ShinyHunters, a data theft and extortion group, exploited a critical zero-day vulnerability in Oracle PeopleSoft—enterprise software used for human resources, payroll, and student records management—to breach more than 100 organizations between May 27 and June 9. The University of Nottingham was among the first publicly confirmed victims, with attackers stealing approximately 40 GB of data containing names, addresses, phone numbers, ethnicities, disabilities, passport numbers, and academic enrollment information from 455,000 unique email addresses. Google's Mandiant and Threat Intelligence Group confirmed the campaign and notified affected organizations after the attacks occurred; Oracle issued a security advisory on June 10 but had not released a patch at the time of reporting. The vulnerability (CVE-2026-35273) has a CVSS severity rating of 9.8 and allows remote, unauthenticated attackers to fully compromise PeopleSoft systems via HTTP. Most affected organizations are based in the United States, with approximately 68% operating in the higher education sector, reflecting ShinyHunters' established pattern of targeting educational institutions for extortion.