The major healthcare sector vendor did not identify the attackers, but ShinyHunters, a prolific group increasingly targeting the sector, claimed responsibility.

The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees.

Oracle still hasn't patched the vulnerability the group has been using in its attacks since late May.

Too many defenders and researchers are paying attention to defects and unsubstantiated exploit concepts that aren’t worth their time, VulnCheck’s Caitlin Condon said.

The Ivy League school said it was one of almost 100 organizations hit by the simultaneous attacks in August.

The newspaper said a “bad actor” contacted the company in late September, prompting an investigation that nearly a month later confirmed the extent of compromise.

The digital engineering services firm said human resources data on nearly 10,500 current and former employees was exposed.

WatchTowr CEO Benjamin Harris

Researchers said malicious activity dates back to early July and active exploitation was observed two months ago.

The notorious ransomware group exploited multiple vulnerabilities, including a zero-day, for at least eight weeks before alleged victims received extortion demands.