BreachPublished 29 Jun 2026

NAIC says public data stolen in ShinyHunters' PeopleSoft breach

Source Bleeping Computer

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2026-35273

Description

The National Association of Insurance Commissioners (NAIC) says the ShinyHunters extortion group stole only publicly available data, outdated logs, and configuration files after breaching its systems by exploiting a zero-day vulnerability in an Oracle PeopleSoft server. [...]

Impact

The breach resulted in the theft of publicly available data, outdated logs, configuration files, and some stored credentials, but no personally identifiable information or sensitive financial data was exposed according to NAIC. Operational impacts included temporary suspension of credit rating agency data feeds and pausing of investment designation work. The incident did not compromise critical insurance regulatory platforms. The attack leveraged a zero-day vulnerability in Oracle PeopleSoft, which has affected multiple organizations beyond NAIC.

Defensive guidance

NAIC has remediated all affected systems and is implementing additional defenses to prevent future attacks. Oracle has publicly disclosed the zero-day vulnerability (CVE-2026-35273) exploited in these attacks. Organizations using Oracle PeopleSoft should apply Oracle's official patches or mitigations as soon as they become available. Since this is not a cloud service, customers must ensure their on-premises PeopleSoft instances are updated. Patch status is not explicitly confirmed in this data; check Oracle's advisory for current remediation guidance.

References

bleepingcomputer.com/news/security/naic-says-public-data-stolen-in-shinyhunters-peoplesoft-breach/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 Jun 2026, 20:36 UTC

References

Community reviews

Related threats