Oracle PeopleSoft servers targeted in data theft attacks linked to ShinyHunters

The notorious data extortion group is exploiting vulnerabilities in legacy enterprise systems and demanding Bitcoin ransoms, raising fresh questions about crypto's role in cybercrime.

by Editorial Team

Wed 10 Jun 2026 · 14:51 EDT 2 min read

In Technology

Oracle Corporation (ORCL) price

Full chart and stats

Loading chart…

Last close: $131
Close-to-close change: +3.5%
Market cap: $394.7B (shares as of 2026-09-07)
P/E (trailing): 20.5 (EPS to 2026-08-31)
Annual revenue: $67.4B USD (FY ended 2026-05-31) 10-K
Annual revenue growth: +17.3% (FY ended 2026-05-31 vs FY ended 2025-05-31) 10-K
Annual net income: 17,087,000,000 USD (FY ended 2026-05-31, attributable to the company) 10-K
Annual operating margin: 30.6% (FY ended 2026-05-31)
Forward P/E: Unavailable: no dated forecast source

Gloria daily close for session Oct 27, 2026. Market cap and trailing P/E use this close with the SEC share total and trailing diluted earnings, each dated next to its figure. Annual revenue, revenue growth, net income and margin show their own fiscal period and link the 10-K. Current context may postdate this article.

Oracle Corporation and its peers

Company	Price	Market cap	P/E (trailing)	Forward P/E	Annual revenue (USD)	Annual revenue growth	Annual net income (USD)	Operating margin
Oracle Corporation ORCL · Price dated Oct 27, 2026 · tokenized ORCLx	$131	$394.7B	20.5	Unavailable	$67.4BFY ended 2026-05-31 · 10-K	+17.3%FY ended 2026-05-31 vs 2025-05-31 · 10-K	17,087,000,000FY ended 2026-05-31, attributable to the company · 10-K	30.6%FY ended 2026-05-31
Palantir Technologies Inc. PLTR · Price dated Oct 27, 2026 · tokenized PLTRx	$199	$477.5B	169.9	Unavailable	$4.5BFY ended 2025-12-31 · 10-K	+56.2%FY ended 2025-12-31 vs 2024-12-31 · 10-K	1,625,033,000FY ended 2025-12-31, attributable to the company · 10-K	31.6%FY ended 2025-12-31
CrowdStrike Holdings Inc. CRWD · Price dated Oct 27, 2026 · tokenized CRWDx	$268	$274.4B	Not meaningfulLoss, diluted EPS −0.45 to 2026-07-31 · SEC filing	Unavailable	$4.8BFY ended 2026-01-31 · 10-K	+21.7%FY ended 2026-01-31 vs 2025-01-31 · 10-K	−162,502,000FY ended 2026-01-31, attributable to the company · 10-K	−6.1%FY ended 2026-01-31
Shopify Inc. SHOP · Price dated Oct 27, 2026	$166	Unavailable	112.0	Unavailable	$11.6BFY ended 2025-12-31 · 10-K	+30.1%FY ended 2025-12-31 vs 2024-12-31 · 10-K	1,231,000,000FY ended 2025-12-31, attributable to the company · 10-K	12.7%FY ended 2025-12-31

Missing figures stay unavailable. Forward P/E requires a dated source. Annual revenue, revenue growth, net income and margin come from each company's own 10-K, in US dollars, and each row shows that fiscal year. Revenue growth compares the fiscal year with the prior year stated in the same 10-K. Net income is the full year amount attributable to the company, or available to common stockholders where the filing states only that, or consolidated net income. Each row names its basis. Trailing P/E reads "Not meaningful" when the dated trailing diluted EPS is a loss or zero. An operating margin appears only when the filing states both the operating income and the revenue for the same year.

Sources: SEC filings, Gloria daily closes and CoinGecko. Oldest record refresh: Oct 28, 2026, 3:36 PM EDT. Refresh is not a price or filing date. Each row shows its price date and its annual fiscal period. Peers use industry code and company size, or editorial selection. Market cap multiplies that row price by the company share total the latest SEC filing states for every share class together. Trailing P/E divides it by trailing diluted earnings from SEC filings. Rolled earnings per share are approximate because share counts can change between periods. Both appear only when the SEC data carries its date, so they are estimates at one price date, not synchronized filing valuations. Not investment advice.

ShinyHunters, one of the most prolific data extortion gangs operating today, has been exploiting Oracle PeopleSoft servers to steal massive troves of sensitive information.

The most significant known incident tied to this campaign hit Wynn Resorts in September 2025. ShinyHunters reportedly gained initial access by exploiting a vulnerability within Wynn’s PeopleSoft system using employee credentials, ultimately exposing the personal identifiable information of over 800,000 employees. That includes names, Social Security numbers, and the kind of data that makes identity theft trivially easy.

How the attacks work, and what ShinyHunters wants

PeopleSoft is Oracle’s enterprise resource planning software, used by large organizations to manage everything from payroll to student records.

In the Wynn Resorts breach, the group leveraged compromised employee credentials to navigate the PeopleSoft environment. Once inside, they exfiltrated a massive dataset and then demanded payment to not leak the stolen information. The ransom request came to 22.34 BTC, roughly equivalent to $1.5 million at the time.

In June 2026, ShinyHunters was tied to a breach at the University of Nottingham, where the target was the Oracle Campus Solutions platform, a PeopleSoft-adjacent system used to manage student records.

ShinyHunters’ broader operation is staggering in scale. The group has claimed responsibility for stealing over 1.5 billion records from more than 1,000 organizations between 2025 and 2026. A significant chunk of that haul came from exploiting Salesforce misconfigurations, but the PeopleSoft attacks represent an expansion into enterprise resource planning systems.

Bitcoin’s persistent role in ransomware economics

ShinyHunters’ ransom demands consistently reference Bitcoin. Not Monero, not any privacy coin, not stablecoins. Bitcoin.

Bitcoin is pseudonymous, not anonymous. Every transaction is recorded on a public ledger, which means law enforcement agencies with sufficient resources can, and do, trace ransom payments.

The $1.5 million BTC demand in the Wynn case is relatively modest by modern ransomware standards. ShinyHunters isn’t encrypting systems and holding operations hostage — they’re stealing data and threatening to publish it. The leverage is reputational damage and regulatory liability, not operational paralysis.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.

More in Technology

See all

Previous storyMIT study finds AI improves misinformation detection but weakens users’ skills

Menu

Crypto sections