The ShinyHunters extortion group breached the National Association of Insurance Commissioners (NAIC) by exploiting a zero-day vulnerability in an Oracle PeopleSoft server, according to BleepingComputer. The attackers accessed systems using an unpatched flaw before the vulnerability was publicly disclosed.
NAIC stated that only publicly available data, outdated logs, and configuration files were stolen in the incident. The organization is notifying affected parties and has taken steps to secure its systems following the breach.
Nissan separately disclosed a data breach impacting current and former employees, also linked to exploitation of an Oracle PeopleSoft vulnerability. The company warned that employee data was compromised in attacks tied to ShinyHunters.
Both organizations emphasize that the stolen data in NAIC's case is limited to non-sensitive information, but Nissan has not specified the extent of the employee data exposed. No patches for the zero-day have been confirmed as available at this time.
The attacks highlight the ongoing risk of unpatched enterprise software, particularly Oracle PeopleSoft, which remains a target for extortion groups like ShinyHunters. Organizations using the platform are urged to prioritize monitoring and apply any vendor updates promptly.