Key facts
- Google's cybersecurity unit Mandiant reported ShinyHunters hackers are exploiting a flaw in Oracle's PeopleSoft software.
- The hackers adapted to defensive guidance and targeted organizations that did not apply Oracle's patch.
- The latest attacks affected dozens of systems globally across various sectors.
- ShinyHunters claimed to have accessed FBI personnel data using the PeopleSoft vulnerability.
- The FBI is aggressively investigating the reported breach.
Google's cybersecurity unit Mandiant announced on Friday that the hacking group ShinyHunters has resumed "mass exploitation" of a security flaw in Oracle's PeopleSoft software. The group had previously targeted organizations using the software earlier in the summer.
Mandiant stated that ShinyHunters adapted to defensive measures implemented after the initial attacks, specifically targeting organizations that had deployed web application firewalls but had not yet applied an update released by Oracle to fix the vulnerability. The initial exploitation period occurred from May 27 through June 9 and primarily affected universities.
ShinyHunters has claimed responsibility for several major data breaches, including the theft of FBI personnel data. Reuters has not independently corroborated this claim. The FBI confirmed on Wednesday that it is "aggressively investigating" the reported breach, which reportedly exposed the names of personnel in sensitive units and included medical and psychiatric records.
The latest wave of attacks has impacted dozens of systems globally across diverse sectors such as higher education, technology, healthcare, agriculture, transportation, and government. The ongoing exploitation of PeopleSoft, a critical human resources software, is likely to raise concerns among organizations that rely on it, even well-resourced institutions.