United States insurance regulators targeted in Oracle hack
Tap title to read story
The National Association of Insurance Commissioners (NAIC), which supports state insurance regulation across all 50 U.S. states, has confirmed it was compromised in a hacking campaign exploiting an Oracle PeopleSoft zero-day vulnerability, tracked as CVE-2026-35273. Oracle issued an out-of-band advisory on June 11, 2026, after Google and others observed active exploitation. NAIC disclosed on June 26 that attackers accessed statutory financial reporting data, credit rating agency information, and technical logs and configuration data. The association said no personally identifiable, payment, or financial account information was exposed and that state insurance departments’ systems were not affected. Extortion group ShinyHunters claims stealing 3.1 TB of data.
Timeline
- Jun 11 Oracle issues PeopleSoft zero-day advisory
- Jun 11 NAIC detects unauthorized access attempt
- Mid Jun Google confirms zero-day exploitation globally
- Jun 18 ShinyHunters lists NAIC on leak site
- Jun 18 Group claims stealing 3.1 terabytes data
- Jun 26 NAIC posts public security incident notice
- Late Jun NAIC reports only regulatory data accessed
- Late Jun ShinyHunters revises earlier data volume claims
Sources
JQJO Editorial Desk · Human reviewed · AI assisted. Report a correction.

























