NAIC says public data stolen in ShinyHunters' PeopleSoft breach

The National Association of Insurance Commissioners (NAIC) disclosed that the ShinyHunters extortion group breached its Oracle PeopleSoft server by exploiting a zero-day vulnerability (CVE-2026-35273). NAIC contends that only publicly available statutory financial reports, outdated logs, and configuration files were stolen, with no PII or financial data exposed. ShinyHunters, after NAIC refused to pay ransom, leaked data and claims to hold 3.1 TB across 105,000 files including stored credentials for critical regulatory platforms. NAIC disputes these claims, stating those platforms were not compromised. The same zero-day has allegedly impacted over 100 organizations, primarily in the education sector.