NAIC BREACH: SHINYUNTERS STEALS PUBLIC DATA VIA PEOPLESOFT ZERO-DAY

NAIC disclosed the incident after ShinyHunters exploited an unpatched vulnerability in its PeopleSoft server. The group, known for extortion-based attacks, has claimed responsibility for the breach. According to NAIC's assessment, the stolen data consists primarily of information already in the public domain, historical system logs, and server configuration details. No current sensitive records or personal information appears to have been compromised. ShinyHunters has previously targeted major corporations and organizations, typically demanding ransom payments and threatening to publish stolen data. The group's breach of NAIC—a regulatory body representing state insurance commissioners—marks another high-profile target. Oracle has not yet released a patch for the exploited zero-day vulnerability. NAIC has notified relevant authorities and is implementing additional security measures to prevent further unauthorized access.