Nissan Americas PeopleSoft Data Breach

Between 27 May and 9 June 2026, threat actors exploited the critical Oracle PeopleSoft vulnerability CVE-2026-35273. Nissan was among the organisations affected. The company was informed by Oracle of a cyber event impacting personnel records of hundreds of companies and later determined that Nissan had been specifically targeted. Exposed data may include contact information, banking details, Social Security / Social Insurance / national ID numbers, financial and tax records, and dependent/beneficiary information belonging to current and former employees in the US, Canada, Mexico and Brazil. Exact number of affected individuals has not been publicly disclosed. Nissan activated incident response, engaged external experts, and implemented additional controls around payroll access.

Nissan uses Oracle PeopleSoft for employee information management, including payroll, tax administration and personnel records across its Americas operations.

Part of the broader ShinyHunters campaign exploiting CVE-2026-35273 (critical unauthenticated RCE in Oracle PeopleSoft PeopleTools / Environment Management components). The campaign targeted approximately 100 organisations / 300 instances, with a heavy focus on higher education but also hitting corporate victims such as Nissan.

Vulnerabilities exploited

• CVE-2026-35273

ShinyHunters is a prolific cybercriminal/extortion group known for large-scale data theft and 'pay or leak' operations, frequently targeting enterprise platforms.

Aliases

• SH
• UNC6240

Attribution sources

• Link to broader ShinyHunters PeopleSoft campaign (CVE-2026-35273)
• Mandiant / Google Threat Intelligence reporting
• Nissan breach notifications
• Media reports

Additional victims

• Current and former employees in the United States, Canada, Mexico, and Brazil

Countries affected

• United States
• Canada
• Mexico
• Brazil

Data types

• PII
• Contact information
• Banking information
• Social Security / Social Insurance / National ID numbers
• Financial and tax information
• Dependent and beneficiary information

Incident response, forensic, notification and monitoring costs; potential regulatory and civil exposure.

Public reaction

Concern among current and former employees over exposure of SSNs, banking and tax data.

Notifications filed with state authorities; investigation ongoing at time of disclosure. Credit and dark web monitoring offered where available.

Security improvements

• Incident response activated
• External cybersecurity experts engaged
• Stricter controls on payroll and direct-deposit changes (corporate network/VPN + additional identity verification)

Significance

Corporate victim of the 2026 ShinyHunters Oracle PeopleSoft zero-day campaign, notable for the sensitivity of HR/payroll data exposed.

Publishing organisations

• The Register
• BleepingComputer
• SecurityWeek
• ClassAction.org

Related events

• 2026 ShinyHunters Oracle PeopleSoft zero-day campaign (CVE-2026-35273)
• EL-0401University of Nottingham Data Breach›

Systems secured after discovery. Full impact assessment and individual notifications continued after public disclosure in late June 2026.

Official documents

• Nissan Americas breach notifications filed with California Attorney General

References

1. [1]Nissan breach notifications
2. [2]The Register
3. [3]BleepingComputer
4. [4]SecurityWeek
5. [5]Mandiant / Google reporting on the wider campaign