Loading story…
Nissan Americas disclosed a data breach affecting current and former employees after Oracle reported a cyber incident involving Oracle PeopleSoft software used for HR, payroll, and personnel records. Nissan said it was specifically targeted and that exposed information may include contact details, banking information, Social Security or other national identification numbers, financial and tax data, and dependent or beneficiary information. The company said the incident affected individuals in the United States, Canada, Mexico, and Brazil, and that it activated incident response procedures, engaged external cybersecurity specialists, secured affected systems, notified authorities, and planned to provide credit and dark web monitoring.
The disclosure follows Oracle’s June security update for a critical PeopleSoft Enterprise PeopleTools zero-day, tracked as CVE-2026-35273, which Oracle said was being actively exploited in the wild. The vulnerability carries a CVSS 9.8 rating and allows an unauthenticated attacker with network access over HTTP to execute arbitrary code, potentially leading to full system compromise. The overlap between Nissan’s breach notice and Oracle’s warning indicates the employee data exposure was tied to exploitation of the PeopleSoft flaw before remediation.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
Nissan Americas issued an official breach notice published on the California Attorney General’s portal on 2026-06-26, stating that a cyber incident involving Oracle PeopleSoft affected current and former employees. Nissan said Oracle informed it that a cyber-event compromised PeopleSoft software used for HR, payroll, and personnel records, and that Nissan was specifically targeted.
On 2026-06-12, Oracle released a security update for Oracle PeopleSoft Enterprise PeopleTools to fix CVE-2026-35273, a critical unauthenticated remote code execution flaw. Oracle said the vulnerability was being actively exploited in the wild.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt.org.eg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nissan North America disclosed that attackers exploited a critical Oracle PeopleSoft zero-day, tracked as **`CVE-2026-35273`**, to access and steal sensitive data tied to current and former employees across the United States, Canada, Mexico, and Brazil. The company’s California breach filing said the incident affected employee and former employee communications, with known breach dates of **May 27, 2026** and **June 9, 2026**. Reporting on the incident said exposed information may include Social Security numbers, national identification numbers, banking details, tax records, and dependent or beneficiary data, prompting Nissan to restrict payroll access, add identity verification for payroll requests, and offer monitoring services where available. The same Oracle PeopleSoft flaw was also used to breach the **National Association of Insurance Commissioners (NAIC)**, which said an unauthorized actor gained access to part of its environment and temporarily reached certain data storage areas before publishing some of the stolen material. NAIC said the exposed data included credit rating agency information and possibly additional technical storage data, while personal information, payment data, NIPR-linked information, and several regulatory systems were not compromised. Oracle said the broader campaign affected hundreds of organizations, and public reporting linked the activity to the **ShinyHunters** extortion group, which has claimed more than 100 victims.
Aug 11, 2026
Nissan Motor Co. confirmed that personal data of approximately 21,000 customers was compromised following unauthorized access to a Red Hat-managed server. The breach, detected in September, affected customers who purchased vehicles or received services at the former Nissan Fukuoka Motor Co. (now Nissan Fukuoka Sales Co.), exposing names, addresses, phone numbers, partial or full email addresses, and other sales-related customer information. No credit card or financial data was reported stolen, and Nissan has stated there is no evidence the leaked information has been misused, though customers are advised to remain vigilant for potential phishing or fraud attempts. The incident originated from a breach of a dedicated GitLab instance managed by Red Hat Consulting, with the intrusion detected by Red Hat on September 26 and Nissan notified on October 3. The Crimson Collective threat actor initially claimed responsibility for the theft of hundreds of gigabytes of data from 28,000 private GitLab repositories, with ShinyHunters later hosting samples of the stolen data on their extortion platform. Nissan has apologized for the incident and pledged to strengthen monitoring of subcontractors and enhance information security measures in response to the breach.
Jun 29, 2026
Oracle released an emergency Security Alert for **CVE-2026-35273**, a critical remote code execution flaw in **PeopleSoft Enterprise PeopleTools** that affects the **Updates Environment Management** component. The vulnerability carries a **CVSS v3.1 score of 9.8** and can be exploited **remotely over HTTP without authentication or user interaction**, creating a path to arbitrary code execution and potential full system compromise. Oracle said the issue affects **PeopleSoft Enterprise PeopleTools 8.61 and 8.62**, and warned that earlier or unsupported versions may also be vulnerable even if they were not formally tested. The company published patches and mitigation guidance, while external reporting said the bug was disclosed by TrendAI Zero Day Initiative researchers **Bobby Gould, Lucas Miller, and Minh Giang**. Organizations were urged to apply updates immediately, limit external exposure of affected systems, monitor for suspicious activity, and keep deployments on supported versions.
Aug 15, 2026