Nissan Discloses Employee Data Breach

Overview

Automaker Nissan has confirmed a data breach affecting current and former employees across North and South America, following exploitation of a zero‑day vulnerability (CVE‑2026‑35273) in Oracle PeopleSoft PeopleTools. The attack, attributed to the ShinyHunters extortion group, is part of a broader campaign that compromised over 300 PeopleSoft instances across 100 organizations.

Breach Details

Aspect	Description
Vulnerability	CVE‑2026‑35273 — Oracle PeopleSoft PeopleTools zero‑day
Threat Actor	ShinyHunters extortion group
Affected Regions	U.S., Canada, Mexico, Brazil
Data Exposed	Contact info, banking details, SSNs, tax records, beneficiary data
Software Impacted	Oracle PeopleSoft HR and Payroll systems

Nissan Americas uses Oracle PeopleSoft to manage employee records, including payroll and tax administration. Oracle confirmed that hundreds of companies were affected by the same campaign, with Nissan specifically targeted for data theft.

Attack Chain

1. Zero‑Day Exploitation — Attackers leveraged the authentication flaw in PeopleTools.
2. Unauthorized Access — Threat actors gained access to employee records and financial data.
3. Data Exfiltration — Sensitive information was stolen and later leaked on ShinyHunters’ site.
4. Extortion Phase — Victims were pressured to pay ransom to prevent public disclosure.

Response and Mitigation

Nissan activated its incident response plan immediately:

• Engaged external cybersecurity experts to contain the breach.
• Secured affected systems and terminated unauthorized access.
• Implemented VPN‑only access for pay slips and direct deposit changes.
• Enhanced identity verification before processing financial transactions.
• Offered credit and dark web monitoring to affected individuals.

Defensive Recommendations

For organizations using Oracle PeopleSoft:

• Apply Oracle patches and mitigations for CVE‑2026‑35273 immediately.
• Restrict external access to PeopleSoft instances via VPN or zero‑trust controls.
• Monitor for ShinyHunters IoCs and unusual data exfiltration patterns.
• Rotate credentials and API keys for all affected systems.
• Conduct employee awareness training to recognize phishing and extortion attempts.

Expert in the Cloud Insight

The Nissan incident illustrates how supply‑chain vulnerabilities in enterprise software can cascade into multi‑organization breaches. By exploiting a zero‑day in Oracle PeopleSoft, ShinyHunters demonstrated the strategic value of targeting shared HR and financial systems that store sensitive data for hundreds of companies.

For CISOs and security leaders, the takeaway is clear: third‑party risk management must extend to core business applications. Continuous patching, network segmentation, and credential rotation are essential to prevent data theft and extortion in hybrid enterprise environments.