PeopleSoft HR systems hit in ShinyHunters expansion to dozens of firms

For HR and people operations leaders, PeopleSoft isn't just another enterprise application—it is the system of record for employee names, government IDs, compensation, benefits, and often occupational health and disability files. Mandiant's finding that ShinyHunters has moved from university-focused attacks to dozens of organizations across healthcare, government, and transportation means that HR data is now being harvested at scale, and a WAF rule alone is not sufficient defense. This is a workforce data crisis, not merely an IT patch management issue.

Google's Mandiant cybersecurity unit disclosed on Friday, September 25, 2026, that the ShinyHunters hacking group has resumed "mass exploitation" of a security flaw in Oracle's PeopleSoft software, bypassing defensive guidance that was issued after an initial wave of attacks in the late spring. The report landed only days after ShinyHunters claimed to have stolen FBI personnel data through the same PeopleSoft vulnerability, a claim Reuters could not corroborate but one that has sharply raised the stakes for every organization running PeopleSoft for human resources, payroll, benefits, and other sensitive workforce functions. Mandiant's central finding is not that attackers discovered a new zero-day, but that they adapted to the web application firewall rules many organizations deployed in response to earlier guidance. The organizations hit in the newest campaign had implemented those WAF rules but had not applied the software update Oracle issued to fix the underlying flaw. That distinction matters because it means the exposed population may be made up of organizations that believed they had done enough by adding a firewall layer while leaving the application itself unpatched.

“

For HR and security teams, the immediate priority is to confirm whether the Oracle PeopleSoft update referenced by Mandiant has been installed, not merely whether a web application firewall rule exists.

The initial campaign ran from May 27 through June 9, 2026 and mainly affected universities. The expanded activity, according to Mandiant, has affected dozens of systems globally and spans higher education, technology, healthcare, agriculture, transportation, and government. Mandiant did not identify individual victims, but the sector mix is a warning for workforce leaders. Higher education and healthcare organizations are heavy PeopleSoft users and hold enormous volumes of employee, student, and patient data, including occupational health, disability, wellness, and insurance records. Transportation and government entities similarly depend on PeopleSoft for personnel administration, background checks, and credentialing. ShinyHunters' claim that it exposed the names of personnel in sensitive FBI units and acquired medical and psychiatric records illustrates how much more than names and email addresses may be at risk in a PeopleSoft compromise.

The FBI said in a September 23 statement that it is "aggressively investigating" the reported breach. Oracle did not respond to requests for comment. The absence of an immediate public confirmation from Oracle places additional pressure on customers who must decide how to assess the claim and what to tell employees. For HR and security teams, the immediate priority is to confirm whether the Oracle PeopleSoft update referenced by Mandiant has been installed, not merely whether a web application firewall rule exists. Organizations also need to inventory every PeopleSoft instance, including older versions, customized modules, and integrations with payroll or benefits providers, because patching in complex HR environments often lags behind central IT standards.