Loading story…
ShinyHunters publicly leaked data from Moody Bible Institute after a "pay or leak" extortion attempt, exposing more than 2.3 million unique email addresses along with names, physical addresses, phone numbers, dates of birth, and other personal details tied to donors, supporters, students, and alumni. Moody said it brought in internal and external cybersecurity specialists to investigate the breach and respond to the disclosure.
The same threat activity has also been linked to attacks on Oracle PeopleSoft deployments, with the National Association of Insurance Commissioners (NAIC) saying attackers exploited a zero-day flaw to gain temporary access to part of its IT environment and steal confidential financial reporting, credit rating agency, and technical data that was later published online. NAIC said the intrusion was part of a broader campaign affecting multiple organizations after ShinyHunters claimed compromises of more than 100 PeopleSoft installations worldwide; the organization said no personally identifiable information or payment account data was involved, remediated affected systems with outside experts, and said the FBI was investigating.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Push Security reported that attackers were abusing OpenAI organization invitations to lure users into attacker-controlled tenants for long-term harvesting of prompts, uploaded files, and API activity. The report said the invitations used OpenAI's legitimate notification system and could bind a victim account to the malicious tenant with a single click.
In June 2026, Moody Bible Institute was targeted in a ShinyHunters "pay or leak" extortion campaign. The incident led to the public release of more than 2.3 million unique email addresses and additional personal data affecting donors, supporters, students, and alumni.
NAIC disclosed that attackers exploited a zero-day vulnerability in Oracle PeopleSoft to access part of its environment and steal confidential financial data, later publishing the stolen material online. The organization said affected systems were remediated with outside cybersecurity support and that the FBI was investigating.
NAIC said it discovered on June 11 that attackers had gained temporary access to part of its IT environment using compromised PeopleSoft-related access tied to a zero-day Oracle PeopleSoft exploit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcehaveibeenpwned.com
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ShinyHunters has claimed a broad intrusion campaign against Oracle PeopleSoft servers, saying it compromised roughly 300 instances across more than 100 organizations, with universities and other education-sector entities appearing to be the primary victims. The group told reporters it exfiltrated sensitive student and administrative records, including applicant, financial aid, immigration, health, and contact data, and identified Nottingham University as one victim; the university acknowledged a cybersecurity incident. One member of the group also said an attempted breach of an FBI PeopleSoft server was intended to post a denial of the gang’s involvement in recent swatting incidents, but that effort allegedly failed. Reporting indicates the attacks are tied to data theft and extortion activity and may involve a gadget chain using older flaws alongside a possible zero-day, with impact varying by PeopleSoft configuration. Independent research found exposed directories containing tooling linked to the campaign, including MeshCentral agents, a defacement script, a credential-spraying tool, and infrastructure associated through TLS certificates with `azurenetfiles[.]net`. Investigators also observed a shell script that parsed `/etc/hosts`, attempted SSH access with common PeopleSoft and Oracle administrative accounts, and dropped a ransom note named `README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT` on compromised internal PeopleSoft servers, while Oracle had not publicly commented on the allegations at the time of reporting.
Jul 3, 2026
ShinyHunters used an Oracle PeopleSoft exploit to compromise organizations in the education sector, with exposed attacker infrastructure showing staging materials, customized MeshCentral agents, and command history tied to the intrusions. Public reporting identified five sequential attacker-controlled IP addresses serving open Python SimpleHTTP directories on port `8888`, while the operators deployed Windows MeshCentral agents disguised as Microsoft Azure services and configured them to beacon to `wss://azurenetfiles.net:443/agent.ashx`, a domain crafted to resemble Azure NetApp Files branding. Google Threat Intelligence Group said more than 100 exposed organizations were notified, and **68%** of them were in higher education; some victims later had stolen data posted on the ShinyHunters data leak site. The recovered `.bash_history` indicated the attackers installed MeshCentral `v1.1.59` on May 27, 2026, added the `acme-client` npm package to automate Let's Encrypt certificates, used `meshctrl.js` for reconnaissance on compromised systems, examined Oracle PeopleSoft and WebLogic configurations, and then connected outbound over SSH to `176.120.22.24`, identified as the public clearnet mirror of the ShinyHunters leak site.
Jun 29, 2026
ShinyHunters claimed responsibility for a major breach affecting Carnival Corporation, with data tied to Holland America Line’s **Mariner Society** loyalty program appearing online after an alleged extortion attempt failed. According to Have I Been Pwned, the leaked dataset contained **8.7 million records** and **7.5 million unique email addresses**, including names, dates of birth, genders, and loyalty program status details. Carnival acknowledged a security incident and said it had identified a phishing attack involving a single user account, while continuing to assess the scope of unauthorized access; the gang separately alleged it also stole terabytes of internal corporate data, a claim that had not been independently verified. The same group also posted a **"Pay or Leak"** notice claiming it had compromised Udemy and stolen more than **1.4 million user records** along with internal corporate data, giving the company a deadline before any public release. Udemy had not confirmed the incident at the time of reporting, leaving the claim unverified, but the allegation fits a broader ShinyHunters campaign targeting SaaS and education organizations through social engineering, credential theft, MFA bypass, and abuse of third-party access. The incidents underscore the group’s continued use of extortion-backed data theft to pressure victims and expose customer information.
Jun 29, 2026