Loading story…
Nissan North America disclosed that attackers exploited a critical Oracle PeopleSoft zero-day, tracked as CVE-2026-35273, to access and steal sensitive data tied to current and former employees across the United States, Canada, Mexico, and Brazil. The company’s California breach filing said the incident affected employee and former employee communications, with known breach dates of May 27, 2026 and June 9, 2026. Reporting on the incident said exposed information may include Social Security numbers, national identification numbers, banking details, tax records, and dependent or beneficiary data, prompting Nissan to restrict payroll access, add identity verification for payroll requests, and offer monitoring services where available.
The same Oracle PeopleSoft flaw was also used to breach the National Association of Insurance Commissioners (NAIC), which said an unauthorized actor gained access to part of its environment and temporarily reached certain data storage areas before publishing some of the stolen material. NAIC said the exposed data included credit rating agency information and possibly additional technical storage data, while personal information, payment data, NIPR-linked information, and several regulatory systems were not compromised. Oracle said the broader campaign affected hundreds of organizations, and public reporting linked the activity to the ShinyHunters extortion group, which has claimed more than 100 victims.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
In a June 26 update, NAIC said the intrusion was part of a broader campaign exploiting an unknown Oracle PeopleSoft vulnerability that affected multiple organizations. It also said operations had largely returned to normal, while online invoice payment via PeopleSoft remained unavailable.
Nissan North America submitted breach-notification materials dated June 25, 2026, concerning a cybersecurity incident affecting employee and former employee communications. The filing listed the known breach dates as May 27 and June 9, 2026.
NAIC publicly disclosed the incident on June 17, confirming that an attacker had accessed part of its environment and that some accessed data was later published. It said several categories of personal, payment, and regulatory system data were not compromised.
NAIC said it detected a security breach on June 11 after an unauthorized actor accessed part of its environment by exploiting a zero-day vulnerability in Oracle PeopleSoft. The organization said it then contained the breach and blocked the attacker’s access.
Nissan's filing identified June 9, 2026, as the end of the breach window for the employee-related cybersecurity incident. The company said current and former staff in the United States, Canada, Mexico, and Brazil may have had sensitive personal data exposed.
Nissan North America listed May 27, 2026, as the start of a cybersecurity incident affecting current and former employee communications and later linked the intrusion to exploitation of Oracle PeopleSoft.
Nissan disclosed that attackers exploited Oracle PeopleSoft zero-day CVE-2026-35273 to steal sensitive personal data from current and former employees. The company said it secured systems, coordinated with Oracle, restricted payroll access, added identity checks, and would offer monitoring services where available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourceinfosecurity-magazine.com
Open sourceoag.ca.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nissan Americas disclosed a data breach affecting current and former employees after Oracle reported a cyber incident involving **Oracle PeopleSoft** software used for HR, payroll, and personnel records. Nissan said it was specifically targeted and that exposed information may include contact details, banking information, Social Security or other national identification numbers, financial and tax data, and dependent or beneficiary information. The company said the incident affected individuals in the United States, Canada, Mexico, and Brazil, and that it activated incident response procedures, engaged external cybersecurity specialists, secured affected systems, notified authorities, and planned to provide credit and dark web monitoring. The disclosure follows Oracle’s June security update for a critical **PeopleSoft Enterprise PeopleTools** zero-day, tracked as `CVE-2026-35273`, which Oracle said was being actively exploited in the wild. The vulnerability carries a **CVSS 9.8** rating and allows an unauthenticated attacker with network access over HTTP to execute arbitrary code, potentially leading to full system compromise. The overlap between Nissan’s breach notice and Oracle’s warning indicates the employee data exposure was tied to exploitation of the PeopleSoft flaw before remediation.
Jul 8, 2026
ShinyHunters publicly leaked data from **Moody Bible Institute** after a "pay or leak" extortion attempt, exposing more than **2.3 million unique email addresses** along with names, physical addresses, phone numbers, dates of birth, and other personal details tied to donors, supporters, students, and alumni. Moody said it brought in internal and external cybersecurity specialists to investigate the breach and respond to the disclosure. The same threat activity has also been linked to attacks on **Oracle PeopleSoft** deployments, with the **National Association of Insurance Commissioners (NAIC)** saying attackers exploited a **zero-day** flaw to gain temporary access to part of its IT environment and steal confidential financial reporting, credit rating agency, and technical data that was later published online. NAIC said the intrusion was part of a broader campaign affecting multiple organizations after ShinyHunters claimed compromises of more than 100 PeopleSoft installations worldwide; the organization said no personally identifiable information or payment account data was involved, remediated affected systems with outside experts, and said the **FBI** was investigating.
Jul 10, 2026
ShinyHunters has claimed a broad intrusion campaign against Oracle PeopleSoft servers, saying it compromised roughly 300 instances across more than 100 organizations, with universities and other education-sector entities appearing to be the primary victims. The group told reporters it exfiltrated sensitive student and administrative records, including applicant, financial aid, immigration, health, and contact data, and identified Nottingham University as one victim; the university acknowledged a cybersecurity incident. One member of the group also said an attempted breach of an FBI PeopleSoft server was intended to post a denial of the gang’s involvement in recent swatting incidents, but that effort allegedly failed. Reporting indicates the attacks are tied to data theft and extortion activity and may involve a gadget chain using older flaws alongside a possible zero-day, with impact varying by PeopleSoft configuration. Independent research found exposed directories containing tooling linked to the campaign, including MeshCentral agents, a defacement script, a credential-spraying tool, and infrastructure associated through TLS certificates with `azurenetfiles[.]net`. Investigators also observed a shell script that parsed `/etc/hosts`, attempted SSH access with common PeopleSoft and Oracle administrative accounts, and dropped a ransom note named `README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT` on compromised internal PeopleSoft servers, while Oracle had not publicly commented on the allegations at the time of reporting.
Jul 3, 2026