Full Report
For the latest discoveries in cyber research for the week of 15th June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The University of Nottingham, a UK research university, has suffered a data breach after ShinyHunters accessed its student records system. The incident affected about 454,600 current and former students and exposed contact details, […] The post 15th June – Threat Intelligence Report appeared first on Check Point Research.
Analysis Summary
# Incident Report: ShinyHunters Exploitation of Oracle PeopleSoft (University of Nottingham)
## Executive Summary
The University of Nottingham suffered a significant data breach orchestrated by the threat actor group "ShinyHunters." The attackers exploited a critical zero-day vulnerability (CVE-2026-35273) in the Oracle PeopleSoft student records system, impacting over 450,000 individuals. The incident resulted in the exfiltration and subsequent online leak of sensitive student and staff records.
## Incident Details
- **Discovery Date:** Early June 2026 (Part of a wider wave of 100+ targeted organizations)
- **Incident Date:** June 2026
- **Affected Organization:** University of Nottingham
- **Sector:** Education / Higher Research
- **Geography:** United Kingdom
## Timeline of Events
### Initial Access
- **Date/Time:** June 2026
- **Vector:** Zero-day exploit
- **Details:** Attackers exploited CVE-2026-35273, a critical Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE) vulnerability in Oracle PeopleSoft Enterprise PeopleTools.
### Lateral Movement
- **Details:** Following initial access via the web-facing PeopleSoft server, attackers leveraged RCE capabilities to move within the records database environment to identify and stage student data.
### Data Exfiltration/Impact
- **Details:** Approximately 454,600 records were compromised. The stolen data included contact details, passport numbers, enrollment information, and fee payment records. This data was later leaked/posted online by the ShinyHunters group.
### Detection & Response
- **Detection:** Identified through threat intelligence monitoring and the appearance of the data on underground forums.
- **Response:** Security analysts linked the breach to a larger campaign targeting over 100 organizations using the same Oracle exploit. The university initiated breach notification protocols for affected students and staff.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2026-35273 (Oracle PeopleSoft).
- **Persistence:** Remote Code Execution (RCE) allowed for the installation of web shells or backdoors (implied by the nature of the exploit).
- **Defense Evasion:** Use of a zero-day vulnerability to bypass standard signature-based detection.
- **Exfiltration:** Systematic extraction of student records from the PeopleTools database.
- **Impact:** Data breach and public disclosure of PII (Personally Identifiable Information).
## Impact Assessment
- **Financial:** Potential regulatory fines (UK GDPR) and costs associated with credit monitoring for 450k+ victims.
- **Data Breach:** Exposure of highly sensitive PII, including passport numbers and financial records.
- **Operational:** Disruption to student record management and administrative services.
- **Reputational:** High public impact due to the scale of the breach and the nature of the stolen data (Passport IDs).
## Indicators of Compromise
- **Vulnerability:** CVE-2026-35273 (Oracle PeopleSoft SSRF/RCE)
- **Actor:** ShinyHunters
- **Associated Traffic:** Unusually high outbound traffic from PeopleSoft servers to external IP addresses (defanged: hxxps[://]shinyhunters[.]com or similar actor-controlled infrastructure).
## Response Actions
- **Containment:** Patching of Oracle PeopleSoft Enterprise PeopleTools to address the zero-day.
- **Eradication:** Investigation of the student records system for residual unauthorized scripts or backdoors.
- **Recovery:** Restoration of secure access to student portals and implementation of Check Point IPS signatures for CVE-2026-35273.
## Lessons Learned
- **Zero-Day Preparedness:** Dependence on a single major enterprise platform (Oracle) creates a single point of failure; rapid patching cycles are essential.
- **Data Minimization:** Sensitive data like passport numbers should be encrypted at rest and access should be strictly audited and limited to prevent mass exfiltration.
## Recommendations
- **Patch Management:** Prioritize the deployment of Oracle’s emergency security updates for PeopleTools.
- **Network Segmentation:** Isolate student record databases from the direct web-facing application layer to prevent lateral movement.
- **Enhanced Monitoring:** Implement IPS/IDS (like Check Point IPS) specifically tuned to detect SSRF and RCE attempts against enterprise ERP systems.
- **Identity Protection:** Offer identity theft protection services to the 454,600 affected individuals due to the exposure of passport data.