Nissan Discloses Employee Data Breach Linked to Oracle PeopleSoft Zero-Day Attacks
Summary
Nissan says attackers accessed current and former employee records through Oracle PeopleSoft. The company is still assessing the impact and has secured affected systems; Mandiant confirmed zero-day exploitation of CVE-2026-35273.
Key points
- Nissan says attackers accessed personnel records through its Oracle PeopleSoft systems; the company has not determined the breach’s full impact.
- Potentially exposed information may include contact, banking, tax, national identification, and dependent or beneficiary details.
- The incident may affect current and former employees in the United States, Canada, Mexico, and Brazil.
- The attacks are linked in reporting to ShinyHunters, which claimed responsibility for a broader PeopleSoft campaign.
- Mandiant confirmed that CVE-2026-35273 was exploited as a zero-day in data-theft attacks from May 27 to June 9; Oracle has not publicly confirmed exploitation.
- Nissan says it secured affected systems, is working with Oracle, and will offer credit and dark web monitoring where available.
- Nissan is restricting access to pay slips and direct-deposit changes to company-network computers or secured VPN connections while adding identity checks.
Article Details
- Victim Organization
- Nissan
- Incident Type
- Data breach involving unauthorized access to employee records after exploitation of an Oracle PeopleSoft vulnerability
- Data Types Exposed
- Employee contact information (potentially exposed)
- Banking information (potentially exposed)
- Social Security numbers (potentially exposed)
- Social Insurance Numbers (potentially exposed)
- National Identification Numbers (potentially exposed)
- Financial and tax information (potentially exposed)
- Dependent and beneficiary information (potentially exposed)
- Operational Impact
- Nissan says it secured affected systems, took steps to end unauthorized access and prevent further disclosure, and restricted access to employee pay slips and direct-deposit changes to company network computers or secured VPN connections while adding identity verification measures for payroll requests.
- Ransom Or Extortion
- No Nissan-specific ransom demand or payment is reported. ShinyHunters claimed responsibility for the wider PeopleSoft attacks, which the article says were data-theft and extortion attacks.
- Claim Status
- confirmed
CVE
Threat Actors
Vendors
Products
Oracle PeopleSoftNissan says a data breach exposed current and former employee information after attackers exploited an Oracle PeopleSoft vulnerability in theft attacks linked to ShinyHunters.PeopleSoft Enterprise PeopleToolsSoon after, Oracle disclosed a critical vulnerability in Oracle PeopleSoft PeopleTools, tracked as CVE-2026-35273, and released emergency mitigations.
Countries
BrazilThe incident may have affected employees in the United States, Canada, Mexico, and Brazil, while Oracle and Mandiant have confirmed widespread exploitation of CVE-2026-35273 across hundreds of organizations.CanadaThe incident may have affected employees in the United States, Canada, Mexico, and Brazil, while Oracle and Mandiant have confirmed widespread exploitation of CVE-2026-35273 across hundreds of organizations.MexicoThe incident may have affected employees in the United States, Canada, Mexico, and Brazil, while Oracle and Mandiant have confirmed widespread exploitation of CVE-2026-35273 across hundreds of organizations.United StatesThe incident may have affected employees in the United States, Canada, Mexico, and Brazil, while Oracle and Mandiant have confirmed widespread exploitation of CVE-2026-35273 across hundreds of organizations.