Loading story…
Nissan Motor Co. confirmed that personal data of approximately 21,000 customers was compromised following unauthorized access to a Red Hat-managed server. The breach, detected in September, affected customers who purchased vehicles or received services at the former Nissan Fukuoka Motor Co. (now Nissan Fukuoka Sales Co.), exposing names, addresses, phone numbers, partial or full email addresses, and other sales-related customer information. No credit card or financial data was reported stolen, and Nissan has stated there is no evidence the leaked information has been misused, though customers are advised to remain vigilant for potential phishing or fraud attempts.
The incident originated from a breach of a dedicated GitLab instance managed by Red Hat Consulting, with the intrusion detected by Red Hat on September 26 and Nissan notified on October 3. The Crimson Collective threat actor initially claimed responsibility for the theft of hundreds of gigabytes of data from 28,000 private GitLab repositories, with ShinyHunters later hosting samples of the stolen data on their extortion platform. Nissan has apologized for the incident and pledged to strengthen monitoring of subcontractors and enhance information security measures in response to the breach.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
In December 2025, Nissan confirmed that approximately 21,000 customers of Nissan Fukuoka Sales Co., Ltd. were affected by the Red Hat breach. The company said names, addresses, phone numbers, and partial email addresses were exposed, while emphasizing there was no evidence of misuse and no operational disruption.
Following the breach, Crimson Collective publicly claimed responsibility and said it had stolen data from Red Hat's private GitLab repositories. ShinyHunters-linked actors were later reported to host sample data and use it for extortion.
After being notified of the incident, Nissan reported the exposure to the Personal Information Protection Commission. The company said it continued investigating the scope and stated there was no evidence of misuse of the data at that time.
Nissan said it was informed on October 3 that data tied to Nissan Fukuoka Sales Co., Ltd. had been exposed through the Red Hat breach. The compromised information affected about 21,000 customers and included personal and sales-related data, but not financial or credit card information.
Red Hat detected unauthorized access to a Red Hat-managed server and self-managed GitLab environment used by Red Hat Consulting. Threat actor Crimson Collective later claimed the intrusion involved theft of about 570 GB of data from private repositories.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nissan Americas disclosed a data breach affecting current and former employees after Oracle reported a cyber incident involving **Oracle PeopleSoft** software used for HR, payroll, and personnel records. Nissan said it was specifically targeted and that exposed information may include contact details, banking information, Social Security or other national identification numbers, financial and tax data, and dependent or beneficiary information. The company said the incident affected individuals in the United States, Canada, Mexico, and Brazil, and that it activated incident response procedures, engaged external cybersecurity specialists, secured affected systems, notified authorities, and planned to provide credit and dark web monitoring. The disclosure follows Oracle’s June security update for a critical **PeopleSoft Enterprise PeopleTools** zero-day, tracked as `CVE-2026-35273`, which Oracle said was being actively exploited in the wild. The vulnerability carries a **CVSS 9.8** rating and allows an unauthenticated attacker with network access over HTTP to execute arbitrary code, potentially leading to full system compromise. The overlap between Nissan’s breach notice and Oracle’s warning indicates the employee data exposure was tied to exploitation of the PeopleSoft flaw before remediation.
Jul 8, 2026
Red Hat confirmed a significant security incident after hackers from a group calling themselves "Crimson Collective" breached the company's GitLab instance. The attackers reportedly exfiltrated nearly 570GB of data, including approximately 800 Customer Engagement Reports spanning from 2020 to 2025. These reports are believed to contain sensitive information such as infrastructure details, authentication tokens, database URIs, and other credentials that could potentially allow unauthorized access to customer networks. In addition to the reports, the attackers claim to have stolen 28,000 private repositories, which included credentials, CI/CD secrets, pipeline configurations, VPN profiles, and infrastructure blueprints. The breach has raised concerns about the exposure of confidential customer and internal Red Hat data, as well as the potential for downstream attacks leveraging the stolen information. Analysis of the leaked data suggests that the attackers obtained a wide array of sensitive materials that could be used for further exploitation or sold on underground forums. The incident highlights the risks associated with source code management platforms and the importance of securing CI/CD pipelines and repository access. Red Hat has acknowledged the breach and is conducting an internal investigation to assess the full scope and impact. The company is working with affected customers to mitigate risks and has likely initiated incident response protocols, including credential rotation and infrastructure reviews. Security experts warn that the exposure of such a large volume of sensitive data could have long-term repercussions for both Red Hat and its customers, especially if the information is weaponized by other threat actors. The breach underscores the need for robust access controls, regular security audits, and rapid response capabilities in managing source code and customer data. Industry observers are closely monitoring the situation for signs of further exploitation or public release of the stolen data. The incident serves as a stark reminder of the evolving threat landscape and the persistent targeting of technology vendors by sophisticated cybercriminal groups. Organizations are advised to review their own security postures, especially regarding third-party software providers and supply chain dependencies, in light of this breach.
Jul 12, 2026
Nissan North America disclosed that attackers exploited a critical Oracle PeopleSoft zero-day, tracked as **`CVE-2026-35273`**, to access and steal sensitive data tied to current and former employees across the United States, Canada, Mexico, and Brazil. The company’s California breach filing said the incident affected employee and former employee communications, with known breach dates of **May 27, 2026** and **June 9, 2026**. Reporting on the incident said exposed information may include Social Security numbers, national identification numbers, banking details, tax records, and dependent or beneficiary data, prompting Nissan to restrict payroll access, add identity verification for payroll requests, and offer monitoring services where available. The same Oracle PeopleSoft flaw was also used to breach the **National Association of Insurance Commissioners (NAIC)**, which said an unauthorized actor gained access to part of its environment and temporarily reached certain data storage areas before publishing some of the stolen material. NAIC said the exposed data included credit rating agency information and possibly additional technical storage data, while personal information, payment data, NIPR-linked information, and several regulatory systems were not compromised. Oracle said the broader campaign affected hundreds of organizations, and public reporting linked the activity to the **ShinyHunters** extortion group, which has claimed more than 100 victims.
Aug 11, 2026