Google’s cybersecurity unit, Mandiant, says the hacking group ShinyHunters has resumed large-scale attacks exploiting a security vulnerability in Oracle’s PeopleSoft enterprise software.
According to a Reuters report published on September 26, 2026, the hackers adapted their methods after organizations introduced security measures following earlier attacks between May 27 and June 9.
Mandiant said the latest campaign targeted organizations that had installed web application firewall protections but had not applied an Oracle software update designed to fix the vulnerability.
The new attacks have reportedly affected dozens of systems worldwide, involving organizations in higher education, technology, healthcare, agriculture, transportation and government.
Earlier attacks primarily affected universities. ShinyHunters has also claimed that it accessed data belonging to the U.S. Federal Bureau of Investigation (FBI) through the same PeopleSoft vulnerability, although Reuters said it could not independently verify that claim.
The FBI said it was “aggressively investigating” reports of the breach.
Reuters previously reported that data allegedly exposed by ShinyHunters included the names of personnel working in sensitive FBI units, as well as medical and psychiatric records.
Oracle did not respond to Reuters’ request for comment.
Tags
World News