Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

US National Association of Insurance Commissioners (NAIC) hit by network compromise

Incident
First reported
Last updated
Happening score
H score 80
2 unique sources, 2 articles

Summary

Hide ▲

NAIC disclosed a security breach that exposed US citizens’ credit rating data and briefly disrupted operations tied to Oracle PeopleSoft. The breach was detected on June 11 and publicly disclosed on June 17, with a later update confirming unauthorized access through a zero-day vulnerability. Some accessed data was published, and the association temporarily suspended insurer-investment designations while containment and recovery work continued. Most operations have returned to normal, but online invoice payment via PeopleSoft remains unavailable.

Related Happenings

National Association of Insurance Commissioners data leak claims

Data Leak
H score82 First: 29.06.2026 23:30 Last: 29.06.2026 23:30 Sources 1

How related: ShinyHunters claimed the attack and leaked the stolen data after the organization refused to pay a ransom.

About this happening: ShinyHunters' June 25 leak update turned the NAIC intrusion into a public data leak and raised questions about what was actually taken from the insurer regulator. The grou...

Open Happening

Oracle PeopleSoft broad zero-day exploitation campaign

Exploitation Wave
H score82 First: 29.06.2026 13:00 Last: 29.06.2026 13:00 Sources 1

How related: The incident was the result of “a broad campaign to exploit a vulnerability in PeopleSoft that was unknown to the developer or software users at the time, which affected multiple organizations,” the NAIC added.

About this happening: A broad PeopleSoft zero-day exploitation campaign exposed multiple organizations to compromise after attackers abused a previously unknown Oracle PeopleSoft vulnerabilit...

Open Happening

Oracle PeopleSoft PeopleTools zero-day RCE (CVE-2026-35273)

Vulnerability
H score58 First: 11.06.2026 22:39 Last: 11.06.2026 22:39 Sources 1

How related: an unauthorized actor gained access to “a portion” of its environment through the exploitation of a zero-day vulnerability in Oracle PeopleSoft, which NAIC uses for internal financial reporting purposes.

About this happening: Oracle PeopleSoft PeopleTools CVE-2026-35273 is a critical zero-day RCE affecting PeopleSoft Enterprise PeopleTools 8.61 and 8.62. Oracle released emergency mitigati...

Latest development: 29.06.2026 23:40

Nissan says it suffered a data breach affecting current and former employees after attackers exploited an Oracle PeopleSoft zero-day associated with CVE-2026-35273. Oracle informed Nissan that personnel records of hundreds of companies may have been obtained and that Nissan was specifically targeted, with potentially exposed data including contact details, banking information, Social Security numbers, Social Insurance Numbers, National Identification Numbers, financial and tax information, and dependent and beneficiary data for employees in the United States, Canada, Mexico, and Brazil.

Open Happening

Charter Communications hit by network compromise linked to ShinyHunters

Incident
H score70 First: 26.05.2026 22:46 Last: 26.05.2026 22:46 Sources 1

About this happening: Charter Communications confirmed a data breach tied to ShinyHunters extortion, with the company saying it is alerting authorities and that no sensitive personal...

Latest development: 29.05.2026 11:29

Have I Been Pwned analyzed leaked Charter Communications data and confirmed that the incident affected 4.9 million accounts, with exposed records including names, email addresses, job titles, phone numbers, and physical addresses. The published data also included a subset of about 85,000 records from an internal employee directory.

Open Happening

Madison Square Garden hit by network compromise linked to Cl0p

Incident
H score38 First: 02.03.2026 15:53 Last: 02.03.2026 15:53 Sources 1

About this happening: Madison Square Garden confirmed a data breach that exposed names and SSNs, and it has started notifying affected people. The compromise involved a hosted Oracle E-Bu...

Open Happening

Timeline

  1. 29.06.2026 13:00 1 articles · 16d ago

    NAIC detects unauthorized access to Oracle PeopleSoft

    Detection Ioc Update

    The US National Association of Insurance Commissioners (NAIC) detected unauthorized access to its environment on June 11 after an actor exploited a zero-day vulnerability in Oracle PeopleSoft used for internal financial reporting.

    Show sources
    Open in new tab
  2. 29.06.2026 13:00 1 articles · 16d ago

    NAIC publicly discloses breach exposing credit rating data

    Initial Disclosure

    The US National Association of Insurance Commissioners (NAIC) publicly disclosed on June 17 that it had suffered a security breach that exposed US citizens' credit rating data.

    Show sources
    Open in new tab
  3. 26.06.2026 03:00 3 articles · 20d ago

    NAIC confirms Oracle PeopleSoft intrusion exposed data and left invoice payments unavailable

    Victim Impact Update

    On June 26, the NAIC said an unauthorized actor gained access to a portion of its environment by exploiting a zero-day vulnerability in Oracle PeopleSoft, obtained temporary access to data storage areas, published some accessed data, and caused some credit rating agencies to pause feeds, which led the association to temporarily suspend assigning designations to insurer investments while online invoice payment via PeopleSoft remained unavailable.

    Show sources
    Open in new tab