Beyond the Perimeter: Building Resilience Against Cloud and SaaS Supply-Chain Attacks
ShinyHunters exploited an Oracle PeopleSoft zero-day to steal data and extort roughly 100 organizations, including the Council of Europe, for up to $2.3M.
Between May and early June 2026, the ShinyHunters group exploited a critical zero-day in Oracle PeopleSoft across about 100 organizations and 300 instances worldwide, per reports cited by The Register. Stolen records included employee and student personal data, payroll, tax, financial and health information, plus immigration and passport documents. AgentCypher.ai estimates extortion demands of $400,000 to $2.3 million per victim, typically in Bitcoin; the Council of Europe refused to pay. The article uses the incident to argue for Zero Trust, supply-chain risk management, rapid patching, encrypted distributed backups and defined recovery-time objectives.
- ShinyHunters exploited a PeopleSoft zero-day across ~100 organizations and 300 ERP instances in May–June 2026.
- Stolen data included payroll, tax, health, immigration and passport records; extortion demands reached $2.3M per victim.
- Perimeter security is deemed obsolete; Zero Trust, identity-centric controls and least privilege are recommended.
- Encrypted, geographically distributed, immutable backups plus tested RTOs are framed as core resilience controls.
- Delayed patching lets automated scanning turn disclosed vulnerabilities into mass exploitation within hours.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1213 Data from Information RepositoriesT1657 Financial Theft
- Vendors
- OraclePeopleSoft
- Products
- PeopleSoft
- Threat actors
- ShinyHunters
- Victims
- Council of Europe
From the original article
5 min read at cybersecuritynews.com
A critical zero-day vulnerability in Oracle PeopleSoft exposed the Council of Europe and scores of other organizations to data theft and extortion in May and early June 2026. The ShinyHunters hacking group exploited the flaw across about 100 organizations and 300 instances worldwide, according to reports cited by The Register.
By Kavichselvan · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.