Nissan Says Breach Claims Involve Third-Party Vendor, Finds No Evidence Its Systems Were Compromised
Summary
Everest claims it stole 910 GB from a file-transfer system at a vendor serving Nissan and Infiniti dealerships. Nissan says its investigation found no evidence its systems or customer information were compromised; Everest threatened to publish the data.
Key points
- Nissan said a cyber incident earlier this year affected an undisclosed third-party vendor.
- Everest claims it breached the vendor’s file-transfer system and took 910 GB of customer, dealership and loan data.
- The vendor provides services to Nissan and Infiniti dealerships across North America.
- Nissan says the incident was isolated to the vendor and information provided to it, and that it found no indication Nissan systems were compromised or Nissan customer information accessed or put at risk.
- Everest claims the breach occurred in January, says an extortion attempt failed, and threatened to release the data; its claims about negotiations are unverified.
- Nissan had separate reported breaches in 2022 and 2023 affecting 22,000 and 53,000 people, and a 2024 cyberattack exposing about 100,000 customers’ and employees’ information in Australia and New Zealand.
Article Details
- Victim Organization
- Undisclosed third-party vendor serving Nissan and Infiniti dealerships
- Incident Type
- Alleged breach and data exfiltration from a vendor's file-transfer system
- Data Types Exposed
- Customer information (claimed)
- Dealership information (claimed)
- Loan information (claimed)
- Affected Records
- Not disclosed
- Affected Data Size
- Everest claimed to have stolen 910 GB of data.
- Operational Impact
- Nissan said the incident was isolated to the vendor and information provided to it. Nissan reported no indication that its systems were compromised or that Nissan customer information was accessed or put at risk. The vendor was continuing its investigation.
- Ransom Or Extortion
- Everest claimed it attempted to extort Nissan in January and threatened to release the allegedly stolen data. The group said the extortion attempt failed; its claims about negotiations were unverified.
- Claim Status
- claimed