Nissan Payroll Data Falls to a PeopleSoft Zero-Day in a Widening ShinyHunters Sweep

When ShinyHunters ransacked Salesforce-linked corporate data across dozens of brands in 2024, the lesson enterprises took away was that the attack surface had migrated from the network edge to the platforms holding the crown jewels. Two years on, the same collective has demonstrated that the lesson was learned imperfectly. On July 3, 2026, Nissan confirmed that current and former employees had personal records exposed after attackers exploited a critical flaw in Oracle PeopleSoft, the human-resources backbone that quietly runs payroll and personnel data for a large slice of the corporate world. The disclosure arrived not in isolation but as one entry in a synchronized cluster, a signal that the incident is less a Nissan problem than a PeopleSoft problem with Nissan's name attached.

Anatomy of the intrusion

According to SecurityWeek, Nissan employee data was breached via an Oracle PeopleSoft hack linked to the ShinyHunters extortion group, a financially motivated crew that has spent the better part of two years monetizing corporate data through public leak threats and negotiated payments. The mechanism was not a phishing lure or a stolen credential but a defect in the software itself.

BleepingComputer reported that attackers exploited CVE-2026-35273, a critical Oracle PeopleSoft remote-code-execution flaw, as a zero-day between May 27 and June 9, 2026, before an emergency June 10 patch closed the window. That chronology matters. For roughly two weeks, the vulnerability was live in the wild with no fix available, which means every exposed PeopleSoft instance was defensible only by luck, network segmentation, or the absence of the attackers' attention. Oracle's decision to ship an out-of-band update on June 10, outside its normal quarterly cadence, underscored how far the exploitation had already progressed by the time defenders were handed a remedy.

Independent analyses of the advisory describe the bug as an unauthenticated path to code execution, requiring no valid login and no user interaction. Flaws of that class collapse the usual layers of defense into a single point of failure. An attacker who can reach the server can, in effect, become the server.

Records exposed and who carries the risk

The sensitivity of the stolen material is what separates this event from a routine breach notice. SecurityWeek reported that potentially stolen data included Social Security numbers, banking, financial and tax information for employees in the United States, Canada, Mexico and Brazil. That is the full payload of an identity-theft toolkit, the specific fields that let a fraudster open credit lines, redirect direct deposits, or file fraudulent tax returns.

The geographic spread is telling. PeopleSoft deployments frequently consolidate HR operations across a company's regional footprint, so a single compromised instance can expose staff on multiple continents at once. For Nissan, that meant four national workforces surfacing in one disclosure. The population of affected individuals also extends beyond the current org chart, reaching former employees whose data lingers in HR systems long after their badges are deactivated. Those individuals are often the least equipped to respond, having no active relationship with the employer and no reason to be watching for a breach letter.

The categories most likely to draw regulatory scrutiny break down as follows:

• Government identifiers, including Social Security numbers, which anchor most forms of financial identity fraud.
• Banking details capable of enabling payroll diversion or unauthorized transfers.
• Tax records that expose income history and filing information.
• Cross-border personal data spanning US, Canadian, Mexican and Brazilian privacy regimes, each with its own notification clock.

One patch, more than a hundred victims

Nissan is a headline, not the story. Reporting on the campaign noted that Mandiant notified more than 100 organizations affected by the wider PeopleSoft intrusion set, with Nissan, Kubota and Aflac confirming theft on July 3. That the three confirmations landed on the same day is not coincidence; it reflects a coordinated notification process working through a shared victim list, with each company reaching the same disclosure threshold at roughly the same moment.

The involvement of Kubota, the Japanese machinery maker, and the Japan unit of insurer Aflac widens the aperture considerably. A payroll-software zero-day does not respect industry boundaries. It reaches whichever firms happened to run the affected PeopleSoft versions, from automakers to equipment manufacturers to financial-services groups. Mandiant's role as the connective tissue, quietly informing scores of organizations that they sat on the wrong side of the vulnerability, illustrates how the modern breach economy is mediated by incident responders long before it becomes public.

SecurityWeek reported that Nissan employee data was breached via an Oracle PeopleSoft hack linked to the ShinyHunters extortion group.

Supply-chain exposure by another name

Nissan did not write PeopleSoft, and neither did Kubota or Aflac. They licensed it, deployed it, and trusted it with their most sensitive employee records. That arrangement is the essence of software supply-chain risk, where a defect introduced upstream propagates downstream into every organization that installed the product. When the vulnerable component is an HR platform of PeopleSoft's ubiquity, the blast radius is measured not in servers but in workforces.

The zero-day window compounds the problem. A patch released on June 10 does nothing for data siphoned on May 28. Organizations that applied Oracle's emergency fix promptly still had to reckon with the possibility that the intrusion predated the remedy, which is precisely the scenario Nissan now confronts. Detection, in these cases, arrives after exfiltration, and remediation becomes an exercise in damage assessment rather than prevention.

The pattern also rewards attackers who invest in platform research over opportunistic scanning. ShinyHunters, in this telling, did not stumble into more than a hundred victims one at a time. The group identified a single high-value dependency, developed an exploit before defenders knew a hole existed, and harvested at scale during the gap. It is an efficient business model, and one that quarterly patch cycles are poorly designed to counter.

Next steps for affected staff and enterprises

For the individuals whose records were taken, the exposure is durable in a way that a leaked password is not. A stolen Social Security number cannot be rotated. That permanence shifts the burden onto ongoing vigilance, credit monitoring, and skepticism toward unsolicited financial outreach, particularly for former employees who may not receive timely notice.

For enterprises running PeopleSoft or comparable business applications, the Nissan disclosure functions as a live case study in dependency risk. Confirming that the June 10 patch is applied is necessary but insufficient; the harder question is whether exploitation occurred during the zero-day window, which requires log review, threat hunting, and the assumption that absence of evidence is not evidence of absence. The regulatory dimension is equally pressing, with four jurisdictions and multiple privacy frameworks now in play for a single company.

None of the affected firms has publicly detailed the scope of ransom demands or negotiations, and the figures cited here are drawn from the outlets named in-text rather than from company filings. What is already clear is the shape of the threat. A financially motivated group weaponized a critical flaw in a platform that thousands of organizations rely on, and it did so before a fix existed. Nissan's disclosure closes one chapter of that story. Given that Mandiant's notifications reached well over a hundred organizations, the full accounting of the PeopleSoft campaign is unlikely to end with the July 3 cluster.