Nissan confirms employee data breach via Oracle PeopleSoft

Nissan Americas has confirmed a data breach exposing sensitive personal information of current and former employees after a widespread cyber campaign exploiting a critical flaw in Oracle PeopleSoft software. The company disclosed the breach in filings with the California Attorney General’s Office this week, revealing that the incident potentially affects individuals in the United States, Canada, Mexico, and Brazil.

The attack stems from the exploitation of a zero-day vulnerability, tracked as CVE-2026-35273, within Oracle’s PeopleSoft software suite, which Nissan uses to manage employee payroll, tax administration, and other personnel records. According to security researchers and Nissan's own notification, threat actors linked to the ShinyHunters extortion group began exploiting this flaw as early as May 27, targeting hundreds of organizations globally before Oracle issued an emergency security patch on June 10. Nissan stated it was specifically targeted within this broader campaign.

While the full scope of the breach is still under investigation, Nissan believes attackers may have accessed a wide array of sensitive data, including employee contact information, banking details,...