Hackers Claim Unauthorised Access to Oracle PeopleSoft Systems Across More Than 100 Organisations

The cybercrime group ShinyHunters has claimed responsibility for compromising Oracle PeopleSoft servers used by more than 100 organisations, including many universities. The alleged breaches were first reported by BleepingComputer.

PeopleSoft is widely used enterprise software that helps organisations manage payroll, human resources, administrative functions, and other business operations. According to a ShinyHunters member, the group gained access to numerous PeopleSoft environments and exfiltrated sensitive data from affected institutions.

The incident highlights how ShinyHunters continues to operate as one of the most active cybercrime groups today. The group is known for targeting vulnerabilities in widely deployed software platforms, allowing it to compromise multiple organisations through a single campaign.

In a message allegedly sent to one victim, the hackers claimed they had stolen student, applicant, financial aid, immigration, health, and administrative records. They also said the data included personal details such as home addresses, phone numbers, email addresses, and dates of birth.

The individual claiming to represent ShinyHunters said that many of the targeted schools had already been breached in separate, unrelated incidents before this campaign.

According to the group member, the original objective was to compromise an FBI PeopleSoft server and publish a statement denying ShinyHunters’ involvement in a recent wave of swatting incidents referenced in an FBI alert issued last month. The hacker claimed that the effort was ultimately unsuccessful.