ShinyHunters exploits PeopleSoft zero day hole as FBI arrests suspected member

Hacking group ShinyHunters has compromised Oracle PeopleSoft software by exploiting a new zero-day vulnerability, CSO Online reported. In response to the breach, security analysts recommend that enterprise customers take extreme measures, specifically pulling the Environment Management Hub and the Integration Broker completely off the public internet. [1]

Law enforcement authorities have made progress in their ongoing pursuit of the cyber criminals involved. CSO Online noted that Reuters reported on Saturday that the FBI arrested a suspected member of ShinyHunters. The arrested individual is cooperating with law enforcement to help identify additional members of the hacking group. [1]

ShinyHunters initial activities began with major breaches in 2020, which involved stealing 91 million records from Tokopedia and 271 million records from Wattpad through unsecured cloud storage and GitHub repositories. The group eventually expanded its operations into voice phishing tactics and enterprise cloud applications, claiming breaches against AT&T for 70 million records in 2022 and Pizza Hut Australia in 2023. [4]

PeopleSoft was originally founded on August 18, 1987, in Walnut Creek, California, before Oracle Corporation acquired it for $10.3 billion in 2005 following an extended hostile takeover attempt. Oracle has maintained development and continued support for the legacy human capital management product line in the decades following the merger. [5]