How one bug exposed 100+ universities — the ERP breach nobody saw coming
In June 2026 attackers used a single unpatched flaw in Oracle's PeopleSoft to break into the systems that hold students' most sensitive records — at more than a hundred organizations, most of them schools. Here is how the boring back-office system became the richest target in the room.
Between late May and early June 2026, a financially motivated crew known as ShinyHunters worked methodically across the internet, hunting for organizations running one specific piece of software: Oracle's PeopleSoft, the decades-old system universities and large employers use to run HR, payroll, finance, and complete student records. They found a flaw nobody had patched — because no patch existed yet. By the time Oracle shipped an emergency fix on June 10, the attackers had broken into more than a hundred organizations, most of them colleges and universities, and had started posting stolen data to extort them. At the University of Nottingham alone, the records of roughly 455,000 students and alumni were exposed.
What happened
ShinyHunters — a data-theft and extortion group, tracked by Google's Mandiant as a cluster called UNC6240 — exploited a vulnerability known as CVE-2026-35273 in Oracle PeopleSoft. It scored 9.8 out of 10 for severity, and the key word is unauthenticated: no login was required. An attacker reaching the system over the internet could take it over outright.
They used it as a zero-day, with exploitation beginning around May 27 — weeks before Oracle's emergency patch on June 10. Mandiant ended up notifying more than a hundred organizations whose systems matched the attack. About 68% were in higher education, most of them in the United States. This was a deliberate, sector-focused campaign against schools.
Why this is worse than a typical breach
The damage comes from concentration. PeopleSoft is not one app — it is the spine that holds HR, payroll, finance, immigration status, and full student records in a single system. So a flaw in it is not access to one database. It is a master key to hundreds of thousands of complete identities at once.
The data confirmed exposed at Nottingham, based on analysis of the leaked set, included names, home addresses, dates of birth, phone numbers, email addresses, ethnicity, disability status, and passport numbers. That is not a list of email addresses to spam — it is everything an identity thief or fraudster could want, packaged per person, at the scale of an entire university.
What ERP is, in plain terms
ERP stands for enterprise resource planning, which is a mouthful for a simple idea: it is the big back-office system that runs an organization's core records. Who works or studies here. What they are paid or what they owe. Their personal details, their status, their history.
Because everything routes through it, ERP is simultaneously indispensable and a single point of catastrophic failure. It is the least glamorous software in the building and the most dangerous to lose. Most people never think about it — which is part of the problem.
Why education got hit hardest
Universities are a near-perfect target, for reasons that have nothing to do with bad luck.
Their IT is large and decentralized — every department its own little kingdom, with systems nobody centrally tracks. They run a lot of legacy, internet-exposed software. Their security budgets and staffing are thin relative to the data they hold. And that data is a permanent, ever-growing store of high-value personal information that never ages out: decades of students' dates of birth, passport numbers, and financial-aid records, sitting in systems that outlive the people who set them up. High value, low resistance — exactly what a mass-extortion crew optimizes for.
Zero-day to mandatory-patch in 48 hours
The timeline is the lesson. Exploitation started around May 27. Stolen data began appearing on the group's leak site on June 9. Oracle pushed an out-of-band emergency patch on June 10. On June 12, the U.S. cybersecurity agency added the flaw to its must-patch catalog with a tight deadline.
The entire cycle — secret exploitation, public disclosure, and a frantic global patch scramble — compressed into about two weeks, with roughly 48 hours between the emergency patch and a government mandate to apply it. Any organization waiting for its normal monthly patch window was already too late.
Steal and shame, not lock and ransom
This was not classic ransomware that encrypts your files. It was the model that has largely replaced it: steal the data, post a sample as proof, and demand payment to not publish the rest. For an institution holding deeply sensitive records on young people and international students, the leverage is the looming reputational damage and regulatory fallout, not locked computers.
One caution worth keeping in mind: groups like ShinyHunters routinely inflate their claims. The independently confirmed facts are the vulnerability, the zero-day exploitation, the 100-plus notified organizations, the higher-education skew, and the Nottingham breach. The largest numbers and the detailed lists of exactly what was taken from each victim are, for now, the group's own claims.
What data-holders should actually do
Treat ERP as your most critical infrastructure, not as a quiet utility. The single biggest move: get its admin and management components off the public internet. The flaw here was reachable in an exposed management hub — the core system and its admin consoles should never be directly accessible from the open internet in the first place.
Patch emergency advisories in days, not months, because this one went from zero-day to government mandate in 48 hours. Segment your network and eliminate reused credentials — the attackers spread internally by spraying the same SSH passwords across many machines. And minimize and encrypt what the ERP retains: the severity of this breach scaled directly with how much sensitive data sat in one reachable place. If you are keeping decades of passport numbers you no longer need, you are storing someone else's risk.
The lesson beyond universities
Every organization has an ERP or its equivalent — the system that quietly holds everyone's everything. It is usually old, usually trusted, usually under-watched, and usually assumed to be safely "internal."
This breach is a reminder that the biggest target is rarely your website or your laptops. It is the unglamorous back-office system with all the data in it. Find yours, get it off the open internet, shrink what it stores, and watch it like it matters — because to an attacker, it is the whole prize.