~/f4n6 $ grep -r "Nissan says Oracle PeopleSoft break-in may have spilled payroll records, SSNs" ./investigations/ --include="*.md"

Nissan says Oracle PeopleSoft break-in may have spilled payroll records, SSNs

Jeff Davies 29 Jun 2026 7 min read

1. Executive summary

Nissan Americas has notified current and former employees across the US, Canada, Mexico, and Brazil that a cyberattack against Oracle PeopleSoft may have exposed payroll records, banking details, Social Security and other national identification numbers, financial/tax records, and dependent/b beneficiary details. Nissan's California AG filing lists a breach window of May 27 through June 9, 2026 — broadly aligning with the previously reported ShinyHunters extortion campaign that claims to have exploited CVE-2026-35273 (CVSS 9.8, critical) against over 100 organisations and roughly 300 PeopleSoft instances. Nissan has not confirmed its incident is connected to the ShinyHunters campaign, and attribution to ShinyHunters is unconfirmed (no MITRE ATT&CK profile exists for this actor). EMEA financial services running PeopleSoft should treat this as an active, broadly targeted campaign against a critical remote unauthenticated vulnerability and act immediately.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 17: ICT-related incident management process Nissan activated an incident response plan after Oracle notified it of a cyber event affecting "hundreds of companies." Financial institutions running PeopleSoft must have an equivalent IR process ready for this same event class. Institutions need a documented, tested process to detect, triage, and respond to a PeopleSoft compromise — including vendor notification, containment, and stakeholder communication.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities A CVSS 9.8 unauthenticated remote compromise of a core HR/payroll platform exfiltrating SSNs, banking details, and tax records meets the threshold of a major ICT-related incident. If a EMEA FS client is affected, they must be prepared to report to the competent authority under DORA Art. 19.
DORA Art. 28: ICT third-party risk — general principles The vulnerability is in Oracle PeopleSoft; Nissan was notified by Oracle, and the compromise may involve Oracle-managed hosting. The incident originates with a critical ICT third-party provider. Institutions must assess their third-party exposure to Oracle as a PeopleSoft provider and ensure contractual provisions (Art. 30) cover incident notification timelines.
NIS2 Art. 21(2)(d): supply chain security measures The vulnerability resides in Oracle-supplied enterprise software (PeopleSoft). Organisations dependent on PeopleSoft are exposed via their software supply chain. NIS2-covered entities must evaluate and address risks arising from their dependency on Oracle PeopleSoft as part of supply chain security measures.
NIS2 Art. 23: incident reporting obligations A critical (CVSS 9.8) unauthenticated remote code execution vulnerability actively exploited in the wild against 100+ organisations constitutes a significant incident requiring notification. NIS2-covered entities that identify compromise or attempted exploitation of their PeopleSoft instances must report to their CSIRT/NCERT within the required timeframe.

3. Technical analysis & attack chain

Confirmed attack chain (corroborated across multiple sources)

  1. Initial access vector: Remote, unauthenticated attacker with network access via HTTP exploits CVE-2026-35273 against Oracle PeopleSoft Enterprise PeopleTools. The vulnerability is rated CVSS 9.8 (critical) and allows full platform takeover. (Source: The Register, corpus-2)
  2. Scope of exploitation: ShinyHunters claims to have compromised over 100 organisations across approximately 300 PeopleSoft instances. More than two-thirds of affected organisations are in higher education. (Sources: BleepingComputer, Cybersecurity Dive, The Register)
  3. Data accessed: HR records, payroll data, billing records, personal data, and other enterprise data. At the University of Nottingham, 40 GB of personal data and billing records for hundreds of thousands of current and former students was stolen. NAIC reportedly lost 3.1 TB of data. (Sources: The Register, SecurityWeek)
  4. Extortion: ShinyHunters operates a data leak site and has published stolen data for victims that refused to pay extortion demands. The University of Nottingham's data was posted on the leak site after the school refused to pay. (Source: The Register, corpus-2)
  5. Vendor response: Oracle issued an out-of-band security alert on June 11, 2026 (one day after the Nottingham data was leaked). Oracle has since released a patch for CVE-2026-35273, though Oracle has not publicly confirmed whether the patch addresses the zero-day exploited by ShinyHunters. (Sources: The Register, SecurityWeek)
  6. Nissan-specific details: Nissan's breach window is May 27–June 9, 2026. Nissan was told by Oracle that "hundreds of companies" were affected. Nissan stated it was "specifically targeted." Affected data categories include: contact information, banking information, Social Security/Social Insurance/national identification numbers, financial and tax records, and dependent/beneficiary details. Affected populations: current and former employees in the US, Canada, Mexico, and Brazil. (Source: The Register, primary item)

Technical specifics of CVE-2026-35273

  • Product: Oracle PeopleSoft Enterprise PeopleTools
  • CVSS: 9.8 (critical) — per verified reference data
  • Access vector: Remote, unauthenticated, via HTTP
  • Impact: Full platform compromise / total takeover
  • Prerequisites: Network access to the PeopleSoft instance over HTTP
  • Patch status: Oracle has released a patch (per SecurityWeek), but Oracle has not publicly confirmed it remediates the zero-day exploited in the ShinyHunters campaign

Nissan containment actions (observed)

  • Pay slip access and direct deposit updates restricted to corporate network or secure VPN only
  • Additional identity verification checks added before processing payroll requests
  • External security specialists engaged
  • Law enforcement notified
  • Credit or dark web monitoring to be offered to affected individuals

Unconfirmed / single-sourced claims (confidence caveat)

  • Attribution to ShinyHunters: The Register links the broader campaign to ShinyHunters, but Nissan has not confirmed its incident is connected. ShinyHunters has no MITRE ATT&CK profile — attribution is unconfirmed. This is a single-sourced attribution (The Register / ShinyHunters spokesperson) — verify before enforcement.
  • Hosting model: The source does not clarify whether the compromised PeopleSoft environment was hosted by Oracle or by Nissan itself. This is unresolved in the source material.
  • Exact vulnerability in Nissan's case: Nissan's employee FAQ attributes the incident to "an unknown vulnerability in Oracle's PeopleSoft software" — Nissan has not specifically named CVE-2026-35273. The connection is inferred from timeline alignment (May 27–June 9 vs. the reported ShinyHunters campaign timeline) and the "hundreds of companies" detail.

4. Mitigation & containment

P1 — Within 24 hours

  1. Inventory all PeopleSoft instances: Identify every PeopleSoft Enterprise PeopleTools deployment in your estate, including Oracle-managed/hosted environments. Document version, patch level, internet exposure, and hosting model.
  2. Restrict network exposure: If any PeopleSoft instance is internet-exposed, immediately restrict access via firewall/WAF rules to corporate VPN or trusted IP ranges only. Block direct HTTP access from untrusted networks. Nissan's own response model (VPN-only access for pay slips/direct deposit) is a reasonable interim control.
  3. Apply Oracle's patch: Oracle has released a patch for CVE-2026-35273. Apply it to all PeopleSoft instances immediately. If patching requires downtime, prioritise internet-facing instances first and use network-level isolation as an interim control.
  4. Hunt for compromise: Search web server logs, application logs, and reverse proxy logs for anomalous unauthenticated HTTP requests to PeopleTools endpoints. Look for signs of data exfiltration: large outbound transfers, unusual HTTP POST responses, or unexpected database query patterns from the application tier.

P2 — Within 72 hours

  1. Review authentication and session logs: Examine PeopleSoft application server logs for unauthenticated access, privilege escalation, or anomalous session creation. Correlate with SIEM alerts for the breach window (May 27–June 9, 2026, and extending to present).
  2. Validate data exfiltration: Check egress logs from PeopleSoft hosts for large outbound transfers. Review database audit logs for bulk queries against HR, payroll, or personal data tables.
  3. Engage Oracle support: Formally request from Oracle: confirmation of whether your environment was affected in the "cyber event" they disclosed to Nissan, the specific vulnerability exploited, patch status, and any IOCs. Document the request and response for regulatory evidence.

P3 — Within 7 days

  1. Implement additional identity verification: Following Nissan's model, add extra identity verification steps for sensitive HR/payroll operations (direct deposit changes, payroll processing, personal data access).
  2. Review third-party contractual provisions: Under DORA Art. 30, ensure contractual provisions with Oracle (or your PeopleSoft hosting provider) include incident notification timelines, vulnerability disclosure obligations, and right-to-audit. If these are absent, initiate renegotiation.
  3. Update incident response playbooks: Incorporate PeopleSoft-specific compromise scenarios into your IR runbooks, including: isolation of application servers, forensic image capture, database audit log preservation, and notification workflows for affected data subjects (employees, dependents, beneficiaries).
  4. Tabletop exercise: Under DORA Art. 24, conduct a tabletop exercise simulating a PeopleSoft zero-day compromise to test detection, containment, and notification workflows.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources do not provide file hashes, IP addresses, domains, user agents, or specific file paths associated with the attack. Specific technical IOCs (if released by Oracle or Mandiant) should be obtained directly from vendor advisories.

6. Detection

The sources do not contain specific IOCs (IPs, domains, hashes, user agents, file paths, registry keys, or distinctive strings) usable for YARA or Sigma rule construction. The only technical artefact available is the CVE identifier (CVE-2026-35273) and the product name (Oracle PeopleSoft Enterprise PeopleTools).

Behavioural detection guidance (manual, not rule-based)

  • Monitor PeopleSoft application server logs for unauthenticated HTTP requests resulting in successful session creation or data access
  • Alert on large outbound data transfers from PeopleSoft hosts (consistent with the 40 GB / 3.1 TB exfiltration volumes reported)
  • Alert on anomalous database queries against HR/payroll tables outside business hours or from unexpected service accounts
  • Monitor for new or unexpected scheduled tasks, services, or scripts on PeopleSoft application servers

Insufficient indicators to author detection rules.

7. Sources

  • The Register — "Nissan says Oracle PeopleSoft break-in may have spilled payroll records, SSNs" — https://www.theregister.com/security/2026/06/29/nissan-says-oracle-peoplesoft-break-in-may-have-spilled-payroll-records-ssns/5263534 — 2026-06-29
  • The Register — "ShinyHunters claims it hacked 100 orgs by exploiting an Oracle PeopleSoft 0-day" — https://www.theregister.com/cyber-crime/2026/06/11/shinyhunters-claims-oracle-peoplesoft-0-day-hit-100-orgs/5254443 — 2026-06-11
  • BleepingComputer — "Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks" — https://www.bleepingcomputer.com/news/security/oracle-peoplesoft-servers-hacked-in-shinyhunters-data-theft-attacks/ — 2026-06
  • Cybersecurity Dive — "ShinyHunters linked to exploitation of critical flaw in Oracle PeopleSoft" — https://www.cybersecuritydive.com/news/shinyhunters-exploitation-critical-flaw-oracle-peoplesoft/822796/ — 2026-06
  • SecurityWeek — "Insurance Regulators Group NAIC Hit in Oracle PeopleSoft Hack" — https://www.securityweek.com/insurance-regulators-group-naic-hit-in-oracle-peoplesoft-hack/ — 2026-06
  • SecurityWeek — "Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks" — https://www.securityweek.com/oracle-addresses-peoplesoft-vulnerability-amid-reports-of-zero-day-attacks/ — 2026-06

8. Adverse Trace position

Severity: HIGH. CVE-2026-35273 is a CVSS 9.8 critical vulnerability enabling remote, unauthenticated full platform compromise via HTTP — the most severe class of web application vulnerability. The campaign is active, broadly targeted (100+ organisations, 300+ instances), and the threat actor has demonstrated both capability and willingness to publish stolen data. EMEA financial services clients running PeopleSoft are directly in scope: HR and payroll systems hold the same categories of sensitive personal data (national IDs, banking details, tax records) that are regulated under GDPR and DORA. Attribution to ShinyHunters is unconfirmed (no MITRE ATT&CK profile; single-sourced via The Register) — we will not treat this as confirmed but will operate on the assumption that the Nissan incident is part of the broader campaign given the timeline alignment and Oracle's notification referencing "hundreds of companies." We are monitoring for Oracle's formal security advisory, patch details, and any IOCs from Mandiant or Oracle. Clients with PeopleSoft instances should apply the Oracle patch immediately, restrict network exposure, and hunt for compromise within the May 27–June 9 window and beyond. We will update this advisory if Oracle releases specific IOCs or confirms the patch remediates the zero-day.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies