NAIC Confirms PeopleSoft Breach, Disputes ShinyHunters’ Data Claims

Summary

NAIC confirmed unauthorized access to its PeopleSoft environment and says data taken was limited to public reports, outdated logs, and configuration files. ShinyHunters claims a much larger haul; NAIC says it found no evidence of exposed PII or financial data.

Key points

NAIC says it discovered unauthorized access to part of its IT systems on June 11 through an Oracle PeopleSoft zero-day, CVE-2026-35273.
NAIC says data taken included publicly available reports, credit-rating data, outdated logs, and configuration information.
NAIC says its investigation found no evidence that PII or financial data was exposed and disputes claims that critical insurance platforms were compromised.
ShinyHunters claims it holds 3.1 TB of data in 105,000 files; the actor’s inventory and NAIC’s findings differ.
The incident temporarily disrupted credit-rating agency data feeds and paused NAIC investment designation work.
NAIC says affected systems have been remediated and additional defenses are being implemented.

Article Details

Victim Organization: National Association of Insurance Commissioners (NAIC)
Incident Type: Unauthorized access to NAIC systems and theft of data following exploitation of an Oracle PeopleSoft zero-day vulnerability
Data Types Exposed: NAIC said accessed or stolen data included publicly available statutory financial reports, credit rating agency data, outdated logs, and configuration information.
ShinyHunters claimed the stolen data included insurer regulatory filing PDFs, customer/order/payment records, rating agency files, AWS infrastructure configurations, and stored credentials for SERFF, OPTins, and UCAA production environments.
NAIC said its investigation found no evidence that personally identifiable information or financial data had been exposed.
Affected Records: ShinyHunters claimed 105,000 files, including 264,000 insurer regulatory filing PDFs, 2,000 customer/order/payment records, and 45,000 rating agency files. NAIC described a narrower set of accessed or stolen data.
Affected Data Size: ShinyHunters claimed to hold 3.1 TB of data; NAIC's findings did not corroborate the full scope of that claim.
Operational Impact: Credit rating agencies temporarily suspended data feeds, and NAIC paused investment designation work. NAIC said affected systems have been remediated and additional defenses are being implemented.
Ransom Or Extortion: ShinyHunters made an extortion demand. NAIC refused to pay, after which ShinyHunters claimed to leak the data. NAIC disputed significant parts of the group's claims.
Claim Status: confirmed