Skip to content

Back to the catalog

Education Under Attack: The Pattern Behind Recent University Breaches
huntress.comarticle

Education Under Attack: The Pattern Behind Recent University Breaches

Huntress breaks down a recurring pattern across 2026 university breaches: Newcastle University's admissions-system misconfiguration exposed ~440,000 contacts, University of Western Australia left Callista student-system credentials exposed online, Avans University had a Power BI misconfiguration leak data for nearly a year, and ShinyHunters breached Instructure's Canvas (defacing login portals during finals week) before exploiting an unpatched RCE flaw in Oracle PeopleSoft across 300+ instances at 100+ organizations. The piece argues higher ed's decentralized IT ownership across departments produces recurring hygiene gaps (misconfigurations, exposed credentials) rather than sophisticated attacks, and that identity/access visibility across distributed environments is the real fix.

TL;DR Huntress ties together five 2026 university breaches (Newcastle, UWA/Callista, Avans/Power BI, Canvas/ShinyHunters, Oracle PeopleSoft) to show higher ed's recurring failure mode is misconfiguration and credential exposure, not sophisticated attacks.
Open original ↗

Organisations named here

  • Avans University of Applied Sciences
  • Caitlin Sarian
  • Jen Easterly
  • Newcastle University
  • University of Western Australia

Technologies named here

  • Newcastle University admissions system
  • Callista
  • Power BI
  • Instructure Canvas
  • Oracle PeopleSoft

Techniques named here

  • Misconfiguration exploitation
  • Exposed credential discovery/use
  • Unpatched remote-code-execution exploitation
  • Data leak site extortion
  • Website defacement
  • Credential-driven ransomware
  • Mailbox hijacking
  • Living-off-the-land techniques

Threat actors named here

  • ShinyHunters

Related in Threat Intel