Google says ShinyHunters hackers targeting education sector via Oracle exploit

Google’s Mandiant and Threat Intelligence Group said they identified an active extortion and compromise campaign by ShinyHunters targeting Oracle PeopleSoft, an enterprise software suite widely used for HR, finance and supply-chain functions. The activity ran from May 27 to June 9 and exploited a zero-day vulnerability before Oracle’s June 10 security advisory. Google notified more than 100 potentially affected organizations, with most located in the U.S. and 68% in higher education. The report highlights a fresh cybersecurity risk for Oracle’s installed base and for institutions that rely on PeopleSoft, especially universities. The news is likely to keep attention on cyber incident exposure for enterprise software vendors and could pressure sentiment around Oracle while reinforcing demand for cybersecurity defenses and monitoring services across education and enterprise customers.