Illinois Central College

On June 15, 2026, ShinyHunters posted Illinois Central College to their leak site, claiming over 28 gigabytes of sensitive HR and payroll data. The attack exploited CVE-2026-35273, the same Oracle PeopleSoft zero-day used against JCPenney, universities, and over 100 other organizations in ShinyHunters' two-week campaign.

ShinyHunters issued a final warning requesting negotiations before proceeding with data publication. When the deadline passed without response, the data was released. Illinois Central College joined Glendale Community College, Moody Bible Institute, and Houston City College as confirmed education sector victims of the PeopleSoft campaign.

28 gigabytes of HR and payroll data. PeopleSoft is HR and finance software. In an educational context, this means employee records, faculty information, salary data, tax forms, benefits enrollment, and administrative staff details.

Community colleges employ hundreds of faculty, adjuncts, administrators, and support staff. Each employee has a comprehensive HR record: Social Security numbers, direct deposit information, W-2 history, emergency contacts, benefit selections. 28GB represents substantial documentation across years of employment records.

Faculty members, adjunct professors, administrative staff, facilities workers, and anyone employed by the college whose data resided in PeopleSoft. Community colleges often employ significant part-time and adjunct workforces—people who may not expect their employment records to surface in a cybercrime leak.

HR data enables identity theft. Payroll data reveals banking relationships. Educational institutions often retain records for years—former employees, retirees, seasonal workers. The exposure extends beyond current staff to anyone whose employment history persisted in the system.

Using Oracle PeopleSoft—enterprise-grade software deployed by thousands of organizations globally, including 68% of ShinyHunters' identified targets being higher education institutions. PeopleSoft is standard infrastructure for universities and colleges managing HR and finance operations.

But the PeopleSoft zero-day was being exploited before Oracle's June 10 patch. Community colleges—with limited IT budgets and security resources compared to large universities—faced an enterprise software vulnerability they couldn't patch because the patch didn't exist yet. The security of employee data depended on vendor vulnerability response timing.

28GB is a substantial data volume. How many years of HR records does that represent? How many former employees whose data should have been purged? How many adjuncts who taught a single semester years ago and never returned?

Educational institutions have high staff turnover, especially in adjunct and part-time positions. PeopleSoft accumulates records across hiring cycles, departures, rehires, and retirements. Without active data minimization, the system becomes a historical archive of everyone who ever worked there—and that archive is what attackers take.

Employee notification across years of records. Illinois state breach notification requirements apply. The college must identify everyone whose data was in the PeopleSoft system—current employees, former employees, retirees—and determine what was exposed.

Community colleges operate on tight budgets. Incident response, forensic investigation, notification mailing, credit monitoring—these costs strain institutions that already face funding pressures. The post-breach burden falls on organizations least equipped to absorb it.