Nissan Americas 2026 Data Breach

Nissan Americas said it uses Oracle PeopleSoft to manage payroll, tax administration, and other personnel records. Oracle informed Nissan of a cyber event in which threat actors may have obtained personnel records belonging to hundreds of companies. Nissan later learned that it had been specifically targeted and explicitly said that data on its systems had been unlawfully accessed.

The California Attorney General's filing identifies the organization as Nissan North America Inc. and lists the known breach dates as May 27 and June 9, 2026. Sample notices dated June 25 for current and former employees are published with the same official filing. LeakData does not substitute the campaign-wide organization count for a Nissan-specific affected-person total.

Nissan said that, at an early stage of its investigation, it believed some personal employee information had been accessed. The disclosed categories include contact information, banking information, United States Social security numbers, Canadian Social insurance numbers or other National Identification numbers, financial and tax information, and dependent or beneficiary information. These classes track the wording in the company's notice.

The company did not say that every field was exposed for every employee and had not finalized file-level findings when the notice was published. The data categories therefore describe the potential confirmed scope and should not be read as applying uniformly to each person.

According to Nissan, the incident may affect current and former Nissan employees in the United States, Canada, Mexico, and Brazil. Because dependent and beneficiary details are among the possible data categories, records about some people connected to employees may also be present. The company did not disclose a country-level or global count of unique people whose information was accessed.

The organization did not publish a verifiable affected-person or record total. An undisclosed count does not mean the incident had no impact; it means the public sources do not provide a reliable total. Oracle's statement that hundreds of organizations may be affected, ShinyHunters' campaign-wide claims, and Nissan's workforce size cannot be used interchangeably. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope.

BleepingComputer connected the incident to a broader data-theft campaign in which CVE-2026-35273 in Oracle PeopleSoft PeopleTools was exploited as a zero-day. Technical findings attributed to Google Mandiant show exploitation between May 27 and June 9 and notification of many organizations. That period aligns with the dates listed in Nissan's official breach filing.

The report says the ShinyHunters group claimed responsibility for the campaign, but Nissan's employee notice does not name an attacker. LeakData therefore does not present the group attribution as a definitive identity confirmed by the company. What is established for Nissan is that an unknown PeopleSoft vulnerability was involved, the organization was directly targeted, and personnel data was accessed without authorization.

Nissan activated incident-response protocols after learning of the event, communicated with authorities, and engaged external cybersecurity experts. Technical teams secured affected systems, began working with Oracle, and took steps designed to end unauthorized access and prevent further disclosure. The company emphasized that its investigation to determine the scope remained in progress.

As a precaution, access to pay slips and direct-deposit changes was restricted to company-network computers or secure VPN connections. Additional identity verification for payroll requests was planned. Nissan said it would offer free credit or dark-web monitoring where available and send detailed follow-up notices to individuals whose information is ultimately confirmed as exposed.

This record does not mean that every global Nissan customer system or connected-vehicle platform was compromised. The confirmed environment is the Oracle PeopleSoft system used by Nissan Americas for employee records, and the disclosed population consists of current and former employees. No confirmed impact to customer accounts, dealer systems, connected-car data, or vehicle telemetry was reported.

The verified conclusion is that Nissan North America was directly targeted in the May 27–June 9, 2026 PeopleSoft attack; some employee personal information may have been accessed; and current and former employees in four countries fall within the potential scope.