ShinyHunters Renew PeopleSoft Attacks: 6 Sectors Hit

For defenders running PeopleSoft, this report should trigger an immediate check of whether Oracle's update was actually applied. The key finding is not the vulnerability itself but the attacker's adaptation: after defensive guidance emphasized WAF rules, ShinyHunters specifically targeted organizations that deployed those rules while skipping the patch. That makes this a case study in compensating control failure with national security implications.

Google's Mandiant unit released a threat intelligence report on September 25, 2026, announcing that the hacking group ShinyHunters has renewed "mass exploitation" of a security flaw in Oracle's PeopleSoft enterprise software. The report, published days after ShinyHunters claimed it had stolen FBI personnel data, signals a significant escalation in a campaign that first came to light in the northern spring. Mandiant's findings indicate the attackers adapted to defensive guidance issued after an earlier wave of attacks, successfully skirting web application firewall (WAF) rules and continuing to compromise organizations worldwide.

“

Google's Mandiant unit released a threat intelligence report on September 25, 2026, announcing that the hacking group ShinyHunters has renewed "mass exploitation" of a security flaw in Oracle's PeopleSoft enterprise software.

The initial exploitation ran from May 27 through June 9, 2026, and primarily affected universities that use PeopleSoft for human resources, student records, and other administrative functions. Oracle subsequently issued a software update to patch the underlying vulnerability, and security teams published guidance focused on WAF rule deployment as a stopgap. However, Mandiant now says ShinyHunters specifically targeted organizations that implemented WAF rules but failed to apply Oracle's patch. That detail turns the episode into a textbook case of why compensating controls cannot replace patching, especially for a platform that stores highly sensitive personnel and financial data. The attackers evidently studied the published remediation guidance and pivoted around it, a behavior consistent with mature cybercriminal operations.

In the latest wave, Mandiant said the attacks affected dozens of systems globally across sectors including higher education, technology, healthcare, agriculture, transportation, and government. The breadth is alarming because it shows the threat actor is not discriminating by vertical or region; any unpatched PeopleSoft instance reachable from the internet may be at risk. PeopleSoft is a legacy but widely deployed Oracle product used by large enterprises, universities, and public-sector bodies for HR and financial management. Many of these environments are complex and patching cycles can lag, making them predictable targets for groups that monitor known vulnerabilities and exploit them at scale.

The renewed exploitation came days after ShinyHunters claimed it had accessed FBI data through a vulnerability in PeopleSoft. Reuters previously reported that the group exposed names of personnel working in sensitive FBI units and acquired medical and psychiatric records. The FBI, in a statement issued September 23, said it was "aggressively investigating" the reported breach. While Reuters has not been able to corroborate the group's claim, the allegation raises the stakes because it suggests the same PeopleSoft flaw may have been used to compromise one of the most security-conscious agencies in the world. If true, it would undermine assumptions that federal law enforcement systems are insulated from enterprise software vulnerabilities.

Oracle did not respond to requests for comment, leaving customers to rely on Mandiant's report and their own incident response teams. The lack of a public statement from Oracle is notable given that the vulnerability affects a product used for critical HR functions. For Oracle investors, the incident could add reputational risk to its cloud and applications business, although the direct financial impact is uncertain. For Google, the Mandiant report reinforces its position as a leading threat intelligence provider, but it also spotlights the continued failure of widely deployed enterprise software to withstand determined attackers.