This Week’s Verdict
The big theme this week is that the expensive, sophisticated attacks aren’t the ones hurting you. The boring ones are. ShinyHunters is methodically working its way through Oracle PeopleSoft installations like a man checking parking meters for unlocked doors, and three different nation-states have collectively figured out that you don’t need a zero-day to wreck a water treatment plant when the password is still on the sticker. Welcome to another week where the fundamentals lost.
The Breaches
The story this week isn’t a breach, it’s a campaign, and it has a body count. Nissan disclosed that current and former employee data was stolen after attackers exploited an Oracle PeopleSoft zero-day. The same flaw, the same group: ShinyHunters, the extortion crew that has spent the last few years monetizing other people’s bad days.
The National Association of Insurance Commissioners (NAIC) got pulled into the same dragnet, and to their credit they’re being relatively honest about the damage: publicly available data, outdated logs, and configuration files. That’s the closest thing to good news in this digest: a victim that segmented well enough that the thieves walked out with the equivalent of an empty filing cabinet and some old receipts. Take note of the contrast. Nissan lost employee PII; NAIC lost yesterday’s garbage. The difference is architecture and discipline, not luck.
What both incidents reveal is the obvious thing nobody wants to say out loud: when a single PeopleSoft zero-day hits, it doesn’t hit one organization. It hits everyone running the same unpatched stack, and ShinyHunters is patient enough to harvest them one at a time.
Vulnerabilities Worth Your Attention
The Oracle PeopleSoft zero-day is the only vulnerability that genuinely matters this week, precisely because it’s already being exploited in the wild against named victims. PeopleSoft is HR and ERP plumbing: it sits on top of the data you least want stolen (employee records, payroll, benefits) and it tends to be the kind of system that gets stood up once and then ignored for a decade because “it just works.” That neglect is exactly what’s being weaponized. If you run PeopleSoft, you are not a bystander to the Nissan and NAIC stories. You’re the next paragraph.
If you’re waiting for me to pad this section with a CVE that lets someone theoretically crash a printer under lab conditions, you’ve got the wrong newsletter.
Threat Actors & Campaigns
ShinyHunters owns the week, and their playbook is depressingly effective: find a widely deployed enterprise platform, develop or acquire a zero-day, and then quietly run the table on every exposed instance before extorting the victims one by one. This isn’t innovation. It’s industrialization.
The more alarming entry is the trio of Iran, Russia, and China turning their attention to water systems. The reporting is clear about the method, and it should embarrass everyone: weak passwords, internet-exposed PLCs, and flat networks with no segmentation. These aren’t nation-state cyber-weapons; they’re the digital equivalent of finding the gate unlocked. The geopolitical framing makes it sound sophisticated. The technical reality is that critical infrastructure operators left the front door open and taped a key under the mat.
On the consumer-malware front, Microsoft caught a malicious Chrome extension impersonating Perplexity, the AI search engine. It logged everything users searched and, this is the nasty part, captured every character typed into the address bar before routing it through an attacker server and quietly redirecting to the real results. Google pulled it after disclosure. The lesson here is old and unlearned: browser extensions are software running with terrifying privileges inside the one application you use for everything, and “it has an AI logo” is not a security review.
The Bigger Picture
Two threads connect this week, and they tie into the same knot.
First: attackers have stopped paying for sophistication they don’t need. ShinyHunters used a zero-day, sure, but the rest of the kill chain is ruthless efficiency, not wizardry. The water-system attackers used nothing but default credentials and exposure. The fake Perplexity extension was social engineering wearing this year’s buzzword. Across the board, the offense is optimizing for return on effort, and we keep handing them cheap wins.
Second, and more uncomfortably: the systems we trust least to be patched are the ones holding our most sensitive data and our most critical functions. PeopleSoft holds employee lives in spreadsheet form. Water PLCs hold an actual city’s drinking supply. Both categories share a fatal trait: they’re “set and forget” infrastructure that nobody owns day-to-day. The breaches this week aren’t a failure of technology. They’re a failure of ownership. Somebody, somewhere, decided those systems were finished. The attackers disagreed.
And before anyone gets too smug about surveillance and privacy, yes, there was a story this week about graphic tees designed to confuse facial-recognition cameras. It’s a cute reminder that the threat model most people actually worry about (being watched) is wildly different from the threat model that’s actually emptying their employer’s HR database. Spend your anxiety wisely.
Patch. Now.
A short list, in priority order:
- Patch Oracle PeopleSoft immediately and assume compromise if you’ve been exposed. Apply Oracle’s emergency fix, hunt for indicators of ShinyHunters activity, and rotate any credentials those systems touched. This is the one that’s actively being exploited against named victims right now.
- Audit every internet-facing PLC and ICS device. Get them off the open internet, kill default and weak passwords, and segment OT from IT like your water supply depends on it,