Global – – October 19, 2026 -- The ShinyHunters extortion gang claims it has stolen data from 300 Oracle PeopleSoft instances across more than 100 organizations, BleepingComputer reported on 10 June 2026. The group says it is targeting both cloud and on-premises deployments of the enterprise suite, which large organizations use for HR, payroll, finance, supply chain, procurement and student administration.
Education sector bears most of the attacks
Most affected organizations are in education, and many were previously extorted by the same actor. ShinyHunters confirmed Nottingham University as a victim and has already published its data on the group's leak site. The university has acknowledged a cybersecurity incident in a statement.
Attackers chain old and zero-day flaws
ShinyHunters says it uses a "gadget chain" combining older and zero-day vulnerabilities. The group concedes the method does not work on every system and believes success depends on how an instance is configured.
Exposed servers reveal ransom-note script
Exposed attacker servers revealed a shell script built to drop a ransom note on breached PeopleSoft hosts. The script parses /etc/hosts to find PeopleSoft-related systems and tries SSH logins with common admin accounts: psoft, oracle and linuxadm. If password logins fail, it falls back to SSH key-based authentication. It then writes the note into PeopleSoft web and application server directories.
The note is named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT.
Seven IP addresses tied to the campaign
Indicators of compromise include five addresses in the 142.11.200[.]186 to 142.11.200[.]190 range, plus 108.174.202[.]99 and 176.120.22[.]24. Several use a TLS certificate with the common name azurenetfiles[.]net, a domain previously linked to ShinyHunters.
Organizations running PeopleSoft should check logs for connections from these addresses. If any appear, they should start incident response and investigate whether the instance was compromised. They should also consider taking affected servers off the internet until the environment is secured and reviewed.