The National Association of Insurance Commissioners has confirmed it was hit by a cyberattack. The notorious ShinyHunters group claims to have walked away with 3.1 terabytes of data from the organization, which oversees insurance regulation across the US.
The attack exploited a zero-day vulnerability in Oracle PeopleSoft, the enterprise software that many large organizations rely on. ShinyHunters started exploiting this particular flaw on May 27, compromising more than 100 organizations before Oracle pushed out an emergency patch on June 10. NAIC detected the intrusion on June 11 and disclosed it a week later on June 17.
NAIC says the stolen data includes publicly available statutory financial reports, insurer investment credit rating data, and technical material like outdated logs and configuration files. They maintain no personal or banking information was accessed.
ShinyHunters disagrees. The group claims the cache includes insurer filings, credit rating files, AWS logs, configurations, and personally identifiable information. They’ve already leaked the data online, suggesting NAIC didn’t pay a ransom.
The disconnect between what NAIC admits was taken and what the attackers claim is hard to ignore. When 3.1TB walks out the door, you can be sure more than just public filings left with it. Organizations using Oracle PeopleSoft should verify they applied the June 10 emergency update immediately.
