NAIC Confirms Cyberattack on PeopleSoft Systems by ShinyHunters The National Association of Insurance Commissioners (NAIC) disclosed a cyberattack on its Oracle PeopleSoft systems, detected on June 11, 2026, and publicly announced on June 23. The breach, attributed to the ShinyHunters hacking group, exploited CVE-2026-35273, a critical unauthenticated remote code execution vulnerability in PeopleSoft Enterprise PeopleTools (versions 8.61 and 8.62) with a CVSS score of 9.8. The flaw, requiring only HTTP network access, was actively exploited between May 27 and June 9, before Oracle issued an advisory on June 10. The attackers gained temporary access to data storage areas, though the NAIC confirmed no personally identifiable information (PII), payment data, or banking details were compromised. Exposed data included publicly available statutory financial reporting information and credit rating agency data, specifically insurer investment ratings. Despite ShinyHunters’ claims of breaching multiple NAIC systems including SERFF, OPTins, UCAA, EDP, and RDC cybersecurity experts verified these were not compromised. Operational disruptions persist: credit rating agencies paused data feeds, and the NAIC temporarily suspended investment designations. Online invoice payments via PeopleSoft remain unavailable. The NAIC, working with Alphabet’s Mandiant and Google Threat Intelligence, has remediated affected systems and blocked unauthorized access. No stolen data has been published as of the announcement. The incident is part of a broader campaign targeting over 100 organizations worldwide, with most victims in the U.S. (68% in higher education). ShinyHunters, known for data theft and extortion, did not deploy ransomware in this attack. The FBI and external cybersecurity firms are investigating, while the NAIC collaborates with credit rating providers to verify system security before resuming full services a process expected to take months. The breach underscores the growing threat to regulatory bodies, which face over 600 million identity attacks daily, per Microsoft Entra data. Oracle’s 14-day delay in issuing a patch left organizations vulnerable, highlighting risks in unpatched enterprise software. The NAIC has engaged its cyber insurance carrier in response.