Check Point Patches Critical Zero-Day Exploited in VPN Attacks Linked to Qilin Ransomware Israeli cybersecurity firm Check Point has released urgent security updates to address a critical authentication bypass vulnerability (CVE-2026-50751) in its Remote Access VPN and Mobile Access deployments. The flaw, actively exploited in zero-day attacks since May 7, allows unauthenticated remote attackers to bypass authentication on vulnerable systems, including Mobile Access/SSL VPNs, Remote Access VPNs, and Spark firewalls. The vulnerability affects only deployments using the deprecated IKEv1 key exchange protocol, specifically those configured to accept legacy Remote Access clients without requiring machine certificate authentication. Exploitation surged in early June, impacting a few dozen organizations globally, with at least one confirmed case tied to the Qilin ransomware operation. Check Point’s investigation also uncovered a second flaw (CVE-2026-50752), which enables man-in-the-middle attacks on site-to-site VPN connections due to improper certificate validation in IKEv1. While no active exploitation of CVE-2026-50752 has been observed, the company urges immediate patching to prevent potential exposure. For organizations unable to patch immediately, Check Point recommends disabling IKEv1 support, enforcing IKEv2-only authentication, mandating machine certificate authentication, and enabling IPS with updated signatures. Qilin, a Ransomware-as-a-Service (RaaS) group active since August 2022, has claimed nearly 400 victims via its dark web leak site, targeting high-profile entities such as Nissan, Asahi, Lee Enterprises, Synnovis, and Australia’s Court Services Victoria. The group’s involvement in the Check Point VPN attacks underscores the growing threat of ransomware actors exploiting critical infrastructure vulnerabilities.

Everest Ransomware Gang Claims 1.4 TB Data Breach from Iron Mountain The Russia-linked Everest ransomware gang has alleged a major data breach at Iron Mountain, an S&P 500 information management company specializing in records storage, data backup, and secure document destruction. The attackers claim to have exfiltrated 1.4 TB of internal documents and client data, posting screenshots on their dark web leak site as proof. The breach, first reported on February 3, remains unconfirmed by Iron Mountain, which stated that only a single compromised login credential was used to access a public-facing file-sharing folder containing primarily marketing materials shared with third-party vendors. The company denied that any customer-sensitive or confidential information was involved but acknowledged it was assessing the situation. Everest, known for high-profile attacks since July 2021, has set a February 11 deadline on its dark web post, a common tactic to pressure victims into paying ransom. The screenshots shared by the group show folder names linked to clients, including potential movie studios and jewelry firms, though the exact contents remain unverified. While no downloadable data has been released, the threat of exposure could have significant reputational and operational consequences for Iron Mountain, which stores valuable intellectual property, master recordings, and trade secrets for global clients. Iron Mountain, founded in a nuclear-resistant former iron mine, operates worldwide with over 11,000 employees and reported $6 billion in revenue in 2024. If confirmed, the breach could undermine trust in its security measures, particularly given its role as a data vault for high-profile industries. The company has not yet verified whether the attackers accessed core storage systems or limited their intrusion to the exposed folder. As of now, the extent of the breach and whether client data was truly compromised remains unclear. Iron Mountain has not disclosed whether it has engaged with the attackers or if a ransom demand was made. The incident follows Everest’s recent targeting of major corporations, including Nissan, ASUS, and Petrobras.

Nissan Targeted in Dark Web Data Leak Threat by Everest Ransomware Gang Nissan Motor Corporation was listed on the dark web on January 10, 2026, by the Everest ransomware gang, which claims to have exfiltrated 900 gigabytes of sensitive data. The threat actors warned that the stolen files including 60,000 text files, 17,000 CSV files, and 78,000 ZIP archives would be published in four days unless a ransom is paid. Samples posted by Everest reveal business-related data, such as marketing and sales records, dealer orders, validation reports, warranty analysis, and communications. Many files appear tied to Nissan’s Canadian operations, referencing dealerships for both Nissan and Infiniti, though some U.S.-based dealer names were also identified. Nissan has not yet issued a public statement on the incident. Everest, a Russian-speaking cybercriminal group active since 2020, has shifted from traditional ransomware attacks to initial access brokering and data extortion. The group has previously targeted high-profile victims, including the 2021 Colonial Pipeline attack, and is known for exploiting weak credentials, insider recruitment, and remote access tools. The Nissan breach follows Everest’s recent claims against Chrysler, where the gang alleged the theft of 1,088 gigabytes of data, including personal and contact information of individuals, agent work logs, and vehicle status records. Chrysler reportedly failed to respond before the deadline, leading to the data’s release. Additionally, Everest recently claimed a breach of ASUS, which the company confirmed stemmed from a compromised supplier, though it denied impact on internal systems or user privacy. No connection between the Chrysler breach and the 2025 Stellantis incident has been confirmed. Nissan has not responded to requests for comment.

Nissan North America Reports Data Breach via Oracle PeopleSoft Exploit Nissan North America has disclosed a data breach involving unauthorized access to its Oracle PeopleSoft system, which manages employee records. The company confirmed it was among multiple organizations targeted in a cyberattack on the platform. An investigation is ongoing, but Nissan believes the breach may have exposed sensitive personal and financial data, including: - Contact information - Banking details - Social Security, Social Insurance, and National Identification numbers - Financial and tax records - Dependent and beneficiary information The incident affects both current and former employees, who are being notified as the investigation progresses. While the exact timeline and scope remain under review, the breach highlights vulnerabilities in third-party HR management systems and the potential for widespread exposure of employee data. Legal teams are examining the incident to determine whether a class action lawsuit could be filed on behalf of affected individuals, though no formal action has been initiated at this time. The breach underscores the risks of supply chain attacks targeting enterprise software providers.

Cyberattacks Surge in the Automotive Industry: Key Incidents from 2024–2025 The automotive sector has become a prime target for cybercriminals, with attacks ranging from ransomware extortion to large-scale data breaches exposing sensitive customer and operational data. Between 2024 and 2025, major automakers, suppliers, and rental companies faced significant disruptions, underscoring the industry’s vulnerability to digital threats. ### Dark Web Trends: U.S. Dominates as Top Target Dark web activity reveals the U.S. as the most discussed and targeted market, accounting for 23% of automotive-related posts, followed by France (8%) and India (7%). While automobile dealers represent less than 1% of dark web chatter, broader sectors like finance, retail, and technical services many tied to automotive operations remain high-risk targets. ### Major Breaches and Ransomware Attacks - Avis Rent a Car (August 2024): Hackers accessed a business application, exposing 299,006 customers’ personal data, including driver’s licenses, credit card details, and contact information. - Toyota (2024–2025): A third-party breach led to the leak of 240GB of data, including employee records, financial documents, and network credentials. The ZeroSevenGroup claimed responsibility, using ADRecon to map Active Directory environments. Toyota emphasized its systems were not directly compromised. - Kawasaki Motors Europe (September 2024): The RansomHub group stole 487GB of sensitive data after a failed ransomware attack, later dumping the files online when Kawasaki refused to pay. - Volkswagen’s Cariad (November 2024): A cloud misconfiguration exposed terabytes of data, including geolocation records from 800,000 vehicles, some linked to German police and intelligence personnel. Researchers traced the breach to an unsecured AWS memory dump. - Hertz (February 2025): The Clop ransomware gang exploited vulnerabilities in Cleo software, accessing customer data between October–December 2024. Over 3,400 Maine residents were affected, though the full scope remains undisclosed. - Scania (May 2025): Hackers stole insurance claim documents using compromised credentials from an IT partner, later attempting extortion. The data was later offered for sale on the dark web. - Cycle & Carriage (July 2024): A Singapore-based dealer suffered a breach affecting 147,000 customers, with 2% of records containing NRIC numbers and deposit details. - Nissan’s Creative Box Inc. (August 2025): The Qilin ransomware gang stole 4TB of design data, including 3D car models and internal documents, threatening to leak them to competitors. - Jaguar Land Rover (August–September 2025): A cyberattack forced the automaker to halt production at multiple plants, disrupting shipments and dealership operations. While no customer data was compromised, the incident caused widespread operational delays. ### Impact and Industry Response These incidents highlight the automotive sector’s expanding attack surface, from third-party vulnerabilities to cloud misconfigurations and ransomware extortion. Companies have responded with containment measures, forensic investigations, and enhanced security protocols, but the frequency and severity of attacks continue to rise. The financial and operational fallout including production halts, data leaks, and reputational damage underscores the urgent need for stronger cybersecurity defenses across the industry.

Nissan Confirms Data Breach Affecting 21,000 Customers After Red Hat Attack Nissan Motor Co. disclosed on Monday that the personal data of approximately 21,000 customers was exposed in a breach at Red Hat, the software supplier responsible for hosting Nissan’s customer management systems. The incident, detected in September, stemmed from unauthorized access to Red Hat’s servers, where attackers exfiltrated data linked to Nissan Fukuoka Sales—a regional dealership in Japan. The compromised information includes full names, physical addresses, phone numbers, email addresses, and other sales-related customer data. Nissan confirmed that financial details, such as credit card information, were not affected, and there is no evidence of misuse. The breach was limited to the affected Red Hat environment, which did not contain additional customer data. The attack on Red Hat was first attributed to the Crimson Collective before the cybercriminal group ShinyHunters publicly leaked samples of the stolen data—hundreds of gigabytes from roughly 28,000 private GitLab repositories—in early October. Following Red Hat’s notification, Nissan promptly alerted Japan’s data protection regulator and directly informed impacted customers. The automaker acknowledged concerns over third-party IT security, stating it is enhancing oversight of external suppliers. This marks Nissan’s second major cybersecurity incident in Japan this year, following a late-August ransomware attack by the Qilin group on its subsidiary, Creative Box. Globally, Nissan has faced repeated breaches, including a 2024 exposure of 53,000 employee records at Nissan North America and a 2023 Akira ransomware attack compromising 100,000 customers in Oceania. Requests for further comment from Nissan’s regional divisions went unanswered.

Nissan Confirms Data Breach Impacting 21,000 Customers Following Red Hat Security Incident In September 2025, U.S.-based software firm Red Hat experienced a security breach that went unacknowledged until October. The full scope of the incident is still emerging, with recent revelations showing its ripple effects across global supply chains. Japanese automaker Nissan has now confirmed that it was indirectly affected by the breach. Hackers accessed detailed contact information for approximately 21,000 customers—all of whom purchased or serviced vehicles at Nissan dealerships in Fukuoka, Japan. Nissan clarified that no financial data was compromised in the incident. The breach originated from Red Hat, which Nissan had contracted to develop a customer management system for its dealerships. According to a translated notice on Nissan’s website, Red Hat detected unauthorized access to its data server on September 26, 2025, and took immediate steps to contain the intrusion. Nissan was formally notified on October 3, 2025, and subsequently reported the incident to Japan’s Personal Information Protection Commission. The company is now directly contacting affected customers. The incident underscores the vulnerabilities in interconnected digital ecosystems, where a breach at a third-party vendor can expose sensitive data across multiple organizations. While Nissan’s exposure was limited to a specific region, the event highlights the broader risks of supply chain cyberattacks.

Hitachi Vantara, a subsidiary of Hitachi, suffered a disruptive Akira ransomware attack on April 26, 2025, forcing the company to take critical servers offline to contain the breach. The incident disrupted internal systems, manufacturing operations, and remote/support services, though cloud services remained unaffected. Customers with self-hosted environments retained access to their data, but government-owned projects were also impacted. The Akira ransomware gang, known for high-profile attacks (e.g., Stanford University, Nissan), stole files from Hitachi Vantara’s network and deployed ransom notes on compromised systems. While the company engaged third-party cybersecurity experts for remediation, the attack caused operational downtime, financial strain (potential ransom demands ranging from $200K to millions), and reputational damage. The FBI reports Akira has extorted $42M+ from over 250 organizations, underscoring the severity of the threat. Hitachi Vantara’s response included proactive containment measures, but the breach highlights vulnerabilities in its infrastructure, risking long-term trust among clients like BMW, Telefónica, and government entities.

A cyberattack that allowed hackers access to personal data was the subject of an investigation by Nissan and affected its systems in Australia and New Zealand. The business notified clients of its Nissan Oceania division of a possible data breach and cautioned them about the possibility of scams in the following days, although no specifics of the incident have been made public. The notice states that in order to assess the extent of the cyberattack, the business has sent out its worldwide incident response team. Nissan is alerting customers to potential frauds that could target them and the risk for account theft.

On May 15, 2024, the Vermont Office of the Attorney General reported a data breach involving Nissan North America. The breach was discovered on November 7, 2023, following a targeted cyberattack. The incident potentially involved the personal information of employees, although the specific types of compromised data were not provided. The number of affected individuals is known to be 17 in Rhode Island and 3 in Vermont.

Nissan Settles $1.5M Over 2023 Phishing Attack Exposing 50,000 Employees’ Data Nissan North America has agreed to a $1.5 million settlement following a November 2023 phishing attack that compromised the personal data of over 50,000 employees. While the company denies wrongdoing, the breach stemmed from a cybersecurity lapse that plaintiffs allege could have been prevented with stronger safeguards. Affected individuals those who received breach notification letters may qualify for compensation or protective services under the settlement. Eligible claims include reimbursement for "ordinary" losses (up to $450 for expenses like bank fees or travel) or "extraordinary" losses (up to $4,500 for fraud or identity theft, with supporting documentation). Those without documented losses can claim up to $100, though payouts may be reduced if claims exceed the settlement fund. Additionally, all impacted employees can receive two years of free credit monitoring, including single-bureau tracking and $1 million in identity theft insurance. Workers who previously enrolled in Nissan’s credit monitoring will have their coverage extended by two years. To participate, claimants must submit a valid form by May 26, 2026, with evidence of losses if applicable. The deadline to opt out or object is April 24, 2026, and final court approval is set for June 1, 2026. The settlement resolves allegations that Nissan’s cybersecurity failures violated privacy rights.

Customers of Nissan North America suffered a data breach incident after a third-party partner exposed customer information. The security incident suffered by its software development affected 17,998 customers. The leaked data included consists of clients’ full names, dates of birth, and NMAC account numbers (Nissan finance account). The manufacturer offers its affected clients a one-year membership of identity protection services through Experian.

Customers of Nissan Canada suffered a data breach incident after a third-party partner exposed customer information. The security incident suffered by its software development affected 1.13 million customers. The compromised information includes the customer's name, address, vehicle make and model, vehicle identification number (VIN), credit score, loan amount, and monthly payment. The manufacturer offers its affected clients a one-year membership of identity protection services through Experian.

Nissan was targeted by the hacktivist group Anonymous in a distributed denial of service (DDoS) attack in January 2016. It took its website offline and temporarily suspended service on it to prevent further risks. The attack was apparently initiated by Anonymous in “#OpWhales” campaign to spread awareness about the killing of dolphins in the cove in Taiji and not for any customer or consumer data.