Nissan employee data exposed in Oracle flaw attack

Attackers went via a previously unknown PeopleSoft vulnerability

Personal information belonging to current and former Nissan employees may have been exposed in a cyberattack, linked to a previously unknown vulnerability in Oracle's PeopleSoft software.

Oracle notified the Japanese carmaker that cyber criminals had targeted systems used by hundreds of organisations in a broader campaign, and later confirmed Nissan had been among those affected.

"Nissan Americas uses Oracle PeopleSoft software to manage employee information, including payroll, tax administration and other personnel records," the company said in breach notifications filed with authorities in California.

Oracle said the attackers may have obtained multiple companies’ personnel records, before Nissan determined that it had been specifically targeted.

The company’s investigation is still at an early stage and it has not yet established the full scale of the incident. However, it believes the compromised information could include employee contact details, banking information, tax records, government identification numbers, as well as details relating to dependants and beneficiaries.

The breach is believed to affect current and former employees in the United States, Brazil, Mexico and Canada.

Nissan has launched its incident response process, hired external cyber security specialists, secured the affected systems and is continuing to work with Oracle as the investigation progresses.

As a precaution, the company has introduced additional restrictions on payroll-related services. Employees can now access electronic payslips or make changes to direct deposit details only through company-managed networks or secure virtual private network (VPN) connections.

Enhanced identity verification checks have also been introduced before payroll requests are processed.

Employees confirmed to have been affected will receive further notifications explaining what information was exposed.

Oracle PeopleSoft zero-day

The disclosure comes amid growing scrutiny of attacks targeting Oracle PeopleSoft systems, after researchers revealed that attackers had exploited a zero-day vulnerability to steal sensitive corporate data.

Oracle later released emergency security updates for the flaw, tracked as CVE-2026-35273, after reports of widespread exploitation.

While the company has not publicly confirmed that attackers leveraged the vulnerability before it was patched, cybersecurity firm Mandiant believes attackers exploited the flaw between late May and early June in a series of data theft operations.

The campaign primarily affected organisations in the education sector, although more than 100 organisations were notified that they may have been compromised.

Attacks linked to ShinyHunters

The attacks have been linked to the cyber extortion group known as ShinyHunters, which claims to have breached more than 300 Oracle PeopleSoft servers across around 100 organisations.

The group has since begun publishing data allegedly stolen during the campaign, including information linked to the University of Nottingham and the National Association of Insurance Commissioners.

ShinyHunters is associated with large-scale data theft campaigns targeting cloud platforms and enterprise software providers. More recently, the group claimed responsibility for an attack on education technology company Instructure, in which it said it stole hundreds of millions of student and staff records.

The latest disclosure is not Nissan's first cyber security incident.

In 2021, the company's North American division took one of its internal Git servers offline after a configuration error left software repositories exposed online, with some of the data later circulating on Telegram channels and hacking forums.