NAIC confirms data breach after Oracle PeopleSoft zero-day exploited by ShinyHunters

On 23 June 2026, the National Association of Insurance Commissioners (NAIC) — the Kansas City–based standard-setting and regulatory-support organization for the chief insurance regulators of the 50 U.S. states, the District of Columbia, and the five U.S. territories — confirmed that it had suffered a data breach after attackers exploited a zero-day vulnerability in Oracle PeopleSoft. The NAIC said unauthorized access to a portion of its environment was identified on 11 June 2026 and that the intrusion was part of a broad campaign that affected multiple organizations worldwide.

What happened

The breach stemmed from active exploitation of CVE-2026-35273, a critical remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools rated 9.8 on the CVSS scale, which requires no authentication and no user interaction. Google's Mandiant attributed the wider campaign to the extortion group it tracks as UNC6240, better known as ShinyHunters, dating the activity from 27 May 2026 — before Oracle issued an out-of-band advisory and patch on 10 June — meaning the flaw was a true zero-day throughout the exploitation window. ShinyHunters has claimed to have compromised more than 100 organizations and over 300 PeopleSoft instances using the bug.

Data exposed

The NAIC said it uses PeopleSoft primarily for internal financial reporting and that its investigation concluded no personally identifiable information or payment data was accessed — specifically no employee data, electronic funds transfer details, risk-based capital data, policyholder information, producer data, or event-registration payment information. ShinyHunters, however, claimed to have exfiltrated more than 3.1 terabytes of data comprising over 105,000 files, and by 25 June 2026 the organization confirmed that the stolen data had been published online by the threat actor.

Context

The NAIC does not directly regulate insurers but provides the technology, data, and model frameworks that underpin state-based insurance regulation across the United States, making it a high-value target whose compromise drew scrutiny from the insurance sector and regulators alike. The incident is one of the more prominent confirmed victims of the ShinyHunters PeopleSoft campaign, which disproportionately hit higher-education institutions but extended to government-adjacent and financial bodies, underscoring how a single unpatched enterprise application can expose large volumes of sensitive organizational data to mass extortion.