Who Are ShinyHunters?
ShinyHunters is a cybercrime group that steals sensitive data and threatens to leak it unless victims pay. Instead of locking files with ransomware, it uses stolen data to pressure victims.
ShinyHunters exploited a flaw to access PeopleSoft systems without logging in.
Google Threat Intelligence Group (GTIG) and Mandiant linked the activity to UNC6240[1], which they track as ShinyHunters. According to Mandiant, the attacks began in late May 2026 and continued into June.
The timing matters here. Oracle published its security alert on June 10[2], after the reported exploitation period. That means organizations could have been exposed before they had an official alert to act on.
