The extortion crew tracked as ShinyHunters spent roughly two weeks inside Oracle PeopleSoft deployments belonging to more than 100 organizations, the majority of them universities, before Oracle published any public warning. Google Cloud's Mandiant team, which tracks the group as UNC6240, says exploitation of CVE-2026-35273 ran from May 27 to June 9, 2026. Oracle's security alert did not land until June 10. The flaw carries a CVSS score of 9.8 and is remotely exploitable without authentication. Mandiant notified over 100 organizations; 68% were in higher education. ShinyHunters claims it hit roughly 300 PeopleSoft instances across about 100 organizations. Moody Bible Institute alone had 2.3 million records exposed.
What Happened
CVE-2026-35273 sits in the Environment Management component of Oracle PeopleSoft Enterprise PeopleTools. Oracle's own advisory describes it as remotely exploitable without authentication, meaning no credentials, no phishing lure, and no user interaction. Network reachability to the exposed service was the only prerequisite.
The timeline is the story. Mandiant places active exploitation between May 27 and June 9, 2026. Oracle's security alert followed on June 10, and the permanent fix arrived in the July 2026 Critical Patch Update. That leaves a two-week stretch in which defenders had no advisory to act on, no patch to apply, and no public indicator set to hunt with. Detection came after the fact.
Two victim numbers are circulating and they should not be merged. Google confirmed exposure and compromise activity at the organizations it notified, a figure above 100. The claim of roughly 300 PeopleSoft instances across about 100 organizations comes from ShinyHunters itself, reported via SecurityWeek and CyberScoop. Criminal self-reporting inflates. Treat the Mandiant notification count as the confirmed floor and the actor's claim as an unverified ceiling.
What Was Taken
PeopleSoft is not a peripheral system. In a university environment it is typically the system of record for student enrollment and academic records, HR files, payroll, finance, and campus administrative data. A pre-authentication compromise of that tier hands an attacker the institution's core identity and financial dataset in one move.
Moody Bible Institute is the clearest disclosed case so far. Roughly 2.3 million records were exposed at the Chicago institution, and ShinyHunters claimed to have stolen approximately 23GB of data, according to TechTimes reporting. For a single institution, that record count far exceeds its current enrollment, which points to historical archives: alumni, former staff, applicants, and dependents rather than only active students.
Full scoping across the other affected organizations is still incomplete. Given the two-week dwell time and the volume of ERP data typically resident in these systems, disclosure counts should be expected to rise rather than settle.
Why It Matters
Higher education is a soft target carrying hard data. Universities run decades of accumulated personal records on ERP platforms that are frequently internet-exposed for remote faculty and student access, maintained by understaffed IT teams, and upgraded on academic-year cycles rather than security cycles. That combination is exactly what this campaign monetized.
The broader lesson is about the advisory gap. Every organization that patched on Oracle's June 10 alert was already 14 days late through no fault of its own. Patch-driven defense assumes the vendor knows first. When the actor knows first, the only controls that matter are the ones that were already in place: network exposure limits, egress monitoring, and detection on anomalous administrative activity.
ShinyHunters also operates as an extortion brand, not a quiet espionage crew. Stolen data here is expected to surface as leak-site pressure and public dumps, which converts a technical incident into a regulatory and reputational one for every institution involved.
The Attack Technique
Mandiant describes an approach that was blunt rather than sophisticated. The group targeted PeopleSoft Environment Management Hub endpoints, including PSEMHUB, reachable over the network. Exploitation of CVE-2026-35273 against those endpoints provided unauthenticated access.
Post-exploitation, the operators ran attacker staging systems and deployed customized MeshCentral agents. MeshCentral is legitimate open-source remote management software, and using a modified build of it lets an attacker maintain persistent remote control while blending into the same category of tooling that IT departments deploy themselves. Mandiant also observed administrative command queries and a custom script built for lateral movement and defacement.
Stripped down, the chain was: internet reconnaissance for exposed PeopleSoft Environment Management endpoints, unauthenticated exploitation, legitimate-looking remote access tooling for persistence, administrative queries against the database tier, and scripted lateral movement. The novelty was in the timing of the vulnerability, not the tradecraft.
What Organizations Should Do
-
Apply the July 2026 Oracle Critical Patch Update immediately if you have not. The June 10 alert mitigation was interim; the permanent fix for CVE-2026-35273 is in the July CPU. Confirm the patch level on every PeopleTools instance, including test, staging, and forgotten development copies that share production data.
-
Take PSEMHUB and Environment Management endpoints off the public internet. These components exist for internal environment administration and have no business being reachable from arbitrary networks. Front them with VPN or zero-trust access, and validate exposure externally rather than trusting network diagrams.
-
Hunt retroactively across May 27 to June 9, 2026. Patching does not evict an actor who was already inside. Look for MeshCentral agents or MeshCentral-like outbound connections, unexpected remote management binaries, new administrative accounts, and unusual query volume against student, HR, and payroll tables.
-
Review egress and data-volume telemetry for that window. A 23GB exfiltration leaves a signature in netflow, proxy logs, and database read counters even when the endpoint tooling looks legitimate. If your logs do not extend back to late May, treat that gap as a finding and fix the retention policy.
-
Inventory every ERP instance and its data scope. Many institutions cannot answer how many PeopleSoft instances they run or which archives sit inside them. The Moody Bible Institute record count relative to enrollment shows why historical data purging is a security control, not just a storage decision.
-
Prepare notification and extortion response in advance. ShinyHunters publicizes. Legal, communications, and regulatory notification workflows should be staged now rather than assembled after data appears on a leak site.