Nobody Breached the Perimeter in June.
They logged in.

Ask a board to picture a breach and they picture a siege — an attacker battering at the firewall until something gives. It is a reassuring image, because a wall is a capital item. You can fund a wall. You can point at it in a slide.

June 2026 does not support that picture. Across the month’s most consequential incidents, the wall held. What failed was everything the wall was never designed to address: an administrative interface that was quietly reachable from the public internet, a set of credentials sitting in a plaintext configuration file, a developer’s account, a third party with standing access. Attackers did not break in. They authenticated.

The campaign that defined the month

Between 27 May and 9 June 2026, the extortion group ShinyHunters — tracked by Google and Mandiant as UNC6240 — ran a campaign against Oracle PeopleSoft, the human-resources and finance platform used across universities, government and large enterprise. The vehicle was CVE-2026-35273, an unauthenticated remote code execution flaw rated CVSS 9.8, sitting in the Updates Environment Management component behind PeopleSoft’s Environment Management Hub.

Oracle did not publish its out-of-band alert until 10 June. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue two days later. For the entire fortnight of exploitation, it was a zero-day, and no patch existed to apply.

The group claims roughly 300 PeopleSoft instances across more than a hundred organisations. Mandiant notified over a hundred organisations whose internet-facing endpoints appeared exposed; sixty-eight per cent were universities and colleges. The University of Nottingham was the first to confirm publicly — 454,600 current and former students’ personal and academic records published to the group’s leak site.

What actually happened after the exploit

The initial access is the least interesting part. What followed is the part that should concern anyone responsible for an assurance programme, because none of it required a novel capability:

• Attacker staging infrastructure hosted customised remote-management agents disguised as legitimate cloud endpoints, so administrative command traffic looked like ordinary SaaS traffic
• A purpose-built lateral movement script sprayed a hardcoded list of usernames and passwords over SSH, against internal hosts read straight out of /etc/hosts
• The attackers read the PeopleSoft application server configuration file — which stores credentials in a form the application can use, and therefore in a form an attacker can use
• Data was compressed and exfiltrated over an outbound SSH session to a mirror of the group’s own leak site
• A taunting marker file was dropped into PeopleSoft directories on the way out

Researchers made the critical observation: the attackers operated inside PeopleSoft’s own application logic, not against the database beneath it. To the application, they looked like legitimate users. Every control designed to detect an intruder crossing a boundary was looking in the wrong direction, because no boundary was crossed.

The credentials were already published

June also produced one of the year’s largest credential exposures: an 8.3 terabyte database, aggregated from thirty-six separate sources — infostealer logs, criminal Telegram channels, prior breach collections, and exports taken directly from live servers. It contained usernames, email addresses, login URLs and plaintext passwords.

That is the supply side of the credential economy, and it is entirely visible from outside an organisation. A staff member’s home machine gets an infostealer. The stealer harvests every saved browser credential, including the corporate SSO session. The log is sold, aggregated, resold, and eventually leaks into a public corpus. No corporate system was ever touched, no alert was ever generated, and the organisation has no visibility whatsoever — unless someone is looking for it deliberately, from the outside.

The same month in Australia

The Australian record for June follows the same logic:

• Two Mackay sugar mills in North Queensland halted operations following a cyber incident — a reminder that operational disruption, not data theft, is the outcome that hurts a producer
• ALS Global saw employee data, passwords, banking details and testing records published by the Aur0ra ransomware group, following an incident disclosed in May
• The Privacy Commissioner ruled that Medmate and Monash IVF breached privacy law through tracking pixels — a landmark finding that health providers must obtain consent before collecting sensitive information this way
• An OAIC sweep found multiple Australian health service websites covertly transmitting sensitive health information to social media platforms
• A long-running OAIC investigation found Optus breached the privacy of 51,000 customers over a 2019 publication error
• The Australian Signals Directorate signalled its intention to retire the Essential Eight within two years

Set against the broader trend, the direction is unambiguous. The OAIC recorded 1,205 breach notifications for calendar year 2025 — an eight per cent rise and an all-time high, with fifty-nine per cent attributed to malicious or criminal attack.

What this means for your obligations

Read June against the Australian regulatory stack and the mapping is uncomfortably direct.

CPS 234 — information asset identification and classification

An APRA-regulated entity must maintain an information asset register and classify assets by criticality and sensitivity. An internet-reachable PeopleSoft management hub is an information asset. If it is not on the register, the control does not exist, regardless of what the policy document says. The exploited endpoints in June were, by definition, discoverable from outside — which means they were discoverable by the organisations that owned them, had anyone looked.

Essential Eight — patch applications

The Essential Eight requires patching internet-facing applications within forty-eight hours of an exploit being available. For a fortnight in June, no patch existed. The control that mattered was not patching — it was minimising what is internet-facing in the first place. Organisations whose Environment Management Hub was not publicly reachable were not exposed to the zero-day at all. That is asset exposure minimisation doing the work that patching could not.

Privacy Act — APP 11 reasonable steps

APP 11.1 requires reasonable steps to protect personal information from unauthorised access. Where an organisation’s credentials sit in a public infostealer corpus and nobody has checked, it becomes difficult to characterise the steps taken as reasonable. Checking is passive, external, and inexpensive. That combination is exactly what makes it hard to defend not having done it.

Four questions worth asking this week

• What answers on the public internet that we did not intend to publish? Not the website. The management consoles, the environment hubs, the staging subdomains, the vendor portals, the forgotten CMS.
• Where do our applications store credentials at rest, and who has read access to those files? If the answer is “the application service account,” the follow-up is: and anyone who compromises it.
• Do our corporate credentials appear in published infostealer data? This is checkable today, from outside, without touching a system.
• Which third parties hold standing, privileged access, and when was that access last reviewed? The contract is not the control.

None of these questions require an internal audit, a vendor questionnaire, or a twelve-week engagement to begin answering. All four are visible from the outside — which is precisely why the attackers found them first.