NAIC breach linked to Oracle PeopleSoft zero-day

The National Association of Insurance Commissioners confirmed that attackers exploited an Oracle PeopleSoft zero-day, obtained credentials, and moved laterally into internal storage.

NAIC said the accessed data primarily consisted of publicly available regulatory and credit-rating information, outdated logs, and configuration files, with no evidence that personal, banking, or payment information was compromised. ShinyHunters claimed a substantially larger theft and published data online, leaving the final scope under forensic review while the incident caused temporary disruption to some insurance data operations.