NAIC Confirms Data Breach Linked to Oracle PeopleSoft Zero-Day Exploit The National Association of Insurance Commissioners (NAIC) confirmed that threat actors exploited a critical zero-day vulnerability in Oracle PeopleSoft’s Environment Management component, exposing financial and ratings data tied to insurer investments. The breach occurred between May 27 and June 9, with stolen data later posted on a leak site. While some of the compromised information was already publicly accessible through state insurance sites or resellers, the incident impacted sensitive regulatory data used by U.S. insurance regulators. Fitch Ratings acknowledged that data it submitted to NAIC was affected but stated its own systems remained secure. Mandiant, Google Cloud’s incident response team, notified over 100 organizations primarily educational institutions about potential exposure. Oracle issued an advisory earlier this month addressing the remote code execution flaw in certain versions of PeopleSoft PeopleTools. NAIC clarified that no financial account data or personally identifiable information (PII) was compromised, and its regulatory filing systems remain secure. However, some ratings agencies, including Kroll Bond Rating Agency, have temporarily paused data feeds to NAIC as a precaution. The breach underscores the risks of unpatched enterprise software, particularly in sectors handling critical regulatory data. The incident follows broader warnings about cyber threats targeting supply chains and high-profile events, though this attack appears focused on exploiting a specific software vulnerability.