Oracle has issued a stark warning to its corporate customers after a cybercrime group called ShinyHunters claimed responsibility for breaching over 100 organizations using PeopleSoft software. This critical vulnerability affects payroll and human resources management systems, leaving companies vulnerable to unpatched attacks.

Mandiant confirmed that ShinyHunters indeed used the zero-day flaw in PeopleSoft servers, which Oracle has yet to address with a patch. The hackers exploited this internet-accessible bug without needing authentication, making it particularly insidious. While some organizations managed to block the activity or remediate the issue, others experienced data breaches.

The ShinyHunters’ campaign has targeted various sectors, including higher education institutions, mirroring their previous attacks on companies using Salesforce and Gainsight software. They threaten victims with data publication unless a ransom is paid—a familiar tactic in the cybercrime world. In a recent incident, the tech company Instructure succumbed to these pressures, paying a ransom after being breached twice.

The latest round of hacking attempts highlights the ongoing challenge faced by tech companies and their users when it comes to security updates and patch management. As ShinyHunters continue to leverage unpatched software for their nefarious purposes, the urgency of timely cybersecurity measures is brought into sharp focus.