ShinyHunters exploits Oracle PeopleSoft zero-day, breaches 100+ organizations including University of Nottingham
By
Jessica Lyons
Summary
ShinyHunters, a data theft and extortion group, exploited a critical Oracle PeopleSoft zero-day vulnerability (CVE-2026-35273) to compromise over 100 organizations across 300 vulnerable instances. The University of Nottingham was among the victims, with 40 GB of personal data and billing records of hundreds of thousands of students stolen. The cybercrime crew confirmed the attack to The Register, indicating this is just the first of many planned disclosures.
Source
bskyShinyHunters exploits Oracle PeopleSoft zero-day, breaches 100+ organizations including University of Nottinghamtheregister.comKey quotes
· 3 pulledA spokesperson for the cybercrime crew on Thursday told The Register that they exploited CVE-2026-35273 to break into the university's PeopleSoft system and steal 40 GB of personal data and billing records belonging to hundreds of thousands of current and former students.
ShinyHunters posted the UK university on its data le
Data theft and extortion group ShinyHunters has exploited a critical Oracle PeopleSoft bug as a zero-day to compromise more than 100 organizations, including the University of Nottingham, across 300 vulnerable instances.
You might also wanna read
CVE-2026-35273: Oracle PeopleSoft RCE Zero-Day Explained
Google Confirms Data Breach in Salesforce CRM Theft Campaign by ShinyHunters
Google has become the latest victim of a data breach in a series of Salesforce CRM data theft attacks orchestrated by the ShinyHunters extor
bleepingcomputer.com·11mo ago
ShinyHunters defaces school Canvas login pages after Instructure data breach
Education tech company Instructure disclosed a data breach where hackers stole student names, emails, and teacher-student messages. The cybe
TechCrunch·2mo ago
Vercel Cloud Platform Hacked via Compromised Third-Party AI Tool
Vercel, a major cloud development platform, was hacked by the ShinyHunters group, who stole employee data including names, email addresses,
The Verge·2mo ago
Checkout.com Responds to Cyber Extortion Attempt Targeting Legacy System
Checkout.com experienced a cyber extortion attempt by the criminal group 'ShinyHunters' who gained unauthorized access to a legacy third-par
checkout.com·7mo ago
Canvas offline after ShinyHunters data breach exposes student information
Canvas, the Instructure-owned learning management platform, is currently down after confirming a massive data breach exposing student names,
The Verge·2mo ago
Comments
Sign in to join the conversation.
No comments yet. Be the first.