3.1TB Stolen: Insurer Data Hit by Zero-Day Attack

A significant zero-day supply chain attack has impacted the National Association of Insurance Commissioners (NAIC), resulting in a substantial data leak on the dark web. The infamous ShinyHunters group has claimed responsibility for the incident, asserting they exfiltrated approximately 3.1TB of sensitive information. The attackers successfully exploited a previously unknown vulnerability in Oracle's PeopleSoft enterprise resource planning software. This exploit allowed them to gain credentials and move laterally within the NAIC's internal systems.

The NAIC detected the breach on June 11 and initiated its incident response protocol, including notifying law enforcement and engaging cybersecurity experts. The incident was publicly disclosed on June 17. While the NAIC stated that only publicly available financial reports, insurer investment credit rating data, and some technical information were accessed, ShinyHunters provided a more extensive list of stolen files. This alleged cache includes thousands of regulatory filing documents, customer orders with personally identifiable information, credit rating agency files, and AWS infrastructure logs.

It is understood that ShinyHunters began exploiting this zero-day vulnerability around May 27, impacting over 100 organizations before Oracle released an emergency security update on June 10. The fact that the data has been leaked suggests that a ransom payment was likely not made by the NAIC.