NAIC Clarifies Scope of Data Exposed After Oracle PeopleSoft Cyberattack

The National Association of Insurance Commissioners (NAIC) has shared new findings from its investigation into a recent cyberattack, saying the incident mainly exposed information that was already publicly available rather than highly sensitive consumer data.

The organization issued the update after the ShinyHunters hacking group claimed responsibility for the breach and alleged it had stolen a massive volume of information. According to NAIC, the investigation has so far found that the attackers accessed mostly public regulatory records along with a limited amount of internal technical data.

Investigation Paints a Different Picture

Initial claims surrounding the attack suggested that a significant amount of sensitive information had been taken. However, NAIC says its forensic investigation has not supported those claims.

Instead, investigators found that the compromised files largely consisted of publicly accessible insurance filings, along with system logs and configuration files used to manage parts of the organization’s IT infrastructure.

At this stage, the association says it has found no evidence that attackers accessed financial information or large collections of personally identifiable data.

Oracle PeopleSoft Flaw Opened the Door

The NAIC data breach occurred after attackers exploited a critical vulnerability affecting Oracle PeopleSoft.

Security researchers have linked the wider campaign to the ShinyHunters cybercrime group, which has targeted organizations running vulnerable Oracle PeopleSoft servers. By exploiting unpatched systems, the attackers gained unauthorized access before many organizations had an opportunity to install Oracle’s security updates.

Insurance Industry Continues to Assess the Impact

Although NAIC believes the stolen information was mostly public, the breach has still prompted a broader review across the insurance sector.

Several organizations that exchange information with NAIC are evaluating the incident and reviewing their own security measures while the investigation continues. Cybersecurity specialists and law enforcement agencies remain involved as investigators work to determine the full scope of the intrusion.

NAIC Data Breach Highlights the Importance of Rapid Patching

The NAIC data breach serves as another reminder that enterprise software vulnerabilities can quickly become attractive targets for cybercriminals.

Organizations using Oracle PeopleSoft should ensure they have installed the latest security updates, review systems for signs of unauthorized activity, and verify that exposed servers remain properly secured. Even when attackers obtain mostly public information, a successful breach can still reveal valuable technical details that may support future attacks.