Nissan Discloses Employee Data Breach Linked to Widespread Oracle Exploits
Automotive giant Nissan has revealed that it suffered a significant data breach affecting current and former employees, following a wave of attacks targeting Oracle PeopleSoft software. The breach is linked to exploits of a zero-day vulnerability in Oracle’s PeopleTools, which was used by threat actors to steal sensitive information from hundreds of companies worldwide.
According to breach notifications filed with the California Attorney General’s Office, Nissan uses Oracle PeopleSoft software to manage employee data, including payroll and tax administration records. In an alert to employees, the company revealed that its systems were compromised after attackers exploited a previously unknown vulnerability in Oracle’s PeopleTools. The affected information includes personal details such as contact information, banking data, Social Security numbers, and financial records.
The breach is believed to impact employees in the United States, Canada, Mexico, and Brazil, with Nissan still investigating the full extent of the incident. As part of its response, the company has engaged external cybersecurity experts, secured affected systems, and is working closely with Oracle to address the issue. Nissan also claims to have taken steps to prevent further unauthorized access or disclosure of employee information.
Interestingly, this breach is linked to a wider campaign of attacks targeting Oracle PeopleSoft servers, which was first reported by BleepingComputer earlier this month. As part of these attacks, threat actors exploited the now-publicly disclosed CVE-2026-35273 vulnerability in Oracle PeopleSoft PeopleTools. It’s worth noting that the ShinyHunters extortion gang claimed responsibility for the attacks, boasting about breaching over 300 PeopleSoft instances across 100 organizations.
While Nissan is still determining the full impact of the breach, it has promised to provide additional notifications and support to employees whose information may have been exposed. To mitigate potential fallout, the company will offer free credit monitoring services to affected individuals where available. As an added precaution, Nissan is restricting access to employee pay slips and direct deposit changes to its internal network or secured VPN connections.
This incident serves as a stark reminder of the ongoing threat posed by zero-day vulnerabilities in enterprise software. With many organizations relying on third-party integrations and cloud-based services, it’s essential for security teams to regularly test their defenses against potential exploits. By staying vigilant and proactive, businesses can reduce their exposure to such attacks and protect sensitive information from falling into the wrong hands.
Practical takeaway: If your organization uses Oracle PeopleSoft software or other enterprise systems, ensure you’re up-to-date with the latest security patches and advisories. Regularly test your defenses against potential exploits using breach and attack simulation tools, and don’t be afraid to engage external experts if needed.
Source: Bleeping Computer — 2026-06-29