INSIGHTS
Oracle PeopleSoft, more than 100 organisations: the MOVEit pattern hits universities
Between 27 May and 9 June 2026 ShinyHunters exploited an unknown Oracle PeopleSoft vulnerability against more than 100 organisations, two thirds of them universities, stealing personal data including sensitive data. The analysis: the MOVEit pattern for the third time, aggregation in education and questions for renewals.
Archive: reconstruction written in November 2026
Topic of the month, June 2026 · by cybercoverinsurance
On 10 June 2026 Oracle published an out-of-band security alert for CVE-2026-35273, a critical vulnerability in PeopleSoft, the enterprise software many universities and large organisations use for staff, students and accounting. The flaw allowed remote code execution without authentication. The group ShinyHunters had been exploiting it since 27 May: Mandiant notified more than 100 organisations, 68% of them universities and colleges, mostly in the United States.
For cyber underwriters the case is the third example in a few years of the same pattern, after MOVEit in 2023 and Cleo in December 2024: widely used enterprise software, an unknown vulnerability, an extortion group hitting dozens of customers at the same time.
What is known
The vulnerability. CVE-2026-35273 has a severity score of 9.8 out of 10 and affects the Environment Management component of PeopleSoft PeopleTools, versions 8.61 and 8.62; according to Oracle, earlier unsupported versions are probably vulnerable too. It requires no authentication or user interaction. Oracle published emergency mitigations and promised a patch soon (BleepingComputer).
The campaign. Malicious activity ran from 27 May to 9 June, before Oracle's alert. Mandiant and Google's threat intelligence group attributed it to ShinyHunters and reconstructed the operation partly thanks to attacker servers left exposed. The attackers compressed and exfiltrated data and left extortion markers on compromised systems. Have I Been Pwned indexed about 455,000 unique email addresses from the published data, which reportedly includes addresses, phone numbers, passport numbers and information on ethnicity and disabilities. The University of Nottingham is among the first confirmed victims (Security Affairs).
The scale. ShinyHunters said it had stolen data from about 300 instances at more than 100 organisations, combining old flaws with the new vulnerability. Inside networks, the attackers installed remote management tools disguised as Microsoft Azure traffic and moved laterally using stolen or hardcoded credentials (BleepingComputer).
What is not known. The final number of organisations with stolen data, how many paid and the total cost of the campaign have not been made public. ShinyHunters said it had only just started contacting victims.
The MOVEit pattern, third time
One software, many victims, one date. As with MOVEit and Cleo, the campaign hit dozens of customers of the same software within days, before a patch existed. For a portfolio, it is an aggregation event with a precise date and a single cause.
Enterprise software as a target. PeopleSoft holds data on staff, students, payroll and accounting. It is not a peripheral system: it is an organisation's central record. A theft from this system produces high notification and liability claims for each victim.
Old versions widen the target. According to Oracle, unsupported versions are probably vulnerable too (Security Affairs). Organisations with outdated installations will not get a patch and must rely on mitigations or upgrades.
The education sector
68% were universities. The campaign mainly hit universities and colleges (Security Affairs). It is the second event of 2026 concentrating aggregation on education, after Instructure in May. For those insuring the sector, common software suppliers are few and widespread.
Sensitive data, heavy obligations. Passport numbers, ethnicity and disability are data that increase notification obligations and litigation risk. The cost per person of a breach is higher when data is of this kind.
Institutions have limited resources. Many universities run complex installations in-house with small IT teams. The speed of applying mitigations after an out-of-band alert is the control that decides whether an institution becomes a victim.
What to bring to renewals
Impact for insurersHigh
An unknown PeopleSoft vulnerability was exploited for two weeks by an extortion group against more than 100 organisations, mostly universities, with theft of personal data including sensitive data.
On the portfolio side, the PeopleSoft case confirms the need to know which internet-facing enterprise software insureds use, especially in concentrated sectors like education. A mass exploitation scenario of widely used software, on the MOVEit, Cleo and PeopleSoft model, is now a recurring event to include in aggregation tests with annual frequency.