HackingManufacturingManufacturingVulnerability ExploitSupply Chain (3P Vendor)TargetedEmployee Data InvolvedZero-DayGovernment IDFinancial accountIdentity (basic)EmploymentMediumActive

NISSAN NORTH AMERICA, INC.

bd_58adcf1efb3d57be · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 26, 2026

To disclose

—

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for NISSAN NORTH AMERICA, INC. →5 incidents on file

Nissan North America Inc. reported a cybersecurity incident involving Oracle PeopleSoft software, where an unknown vulnerability was exploited by threat actors who specifically targeted Nissan. The breach, occurring between May 27 and June 9, 2026, potentially exposed employee personal information including SSNs, banking details, and tax data for current and former employees in the U.S., Canada, Mexico, and Brazil. Nissan activated incident response protocols, engaged experts, and is offering credit monitoring.

J jump to incidentP pin to compareR raw source

California clockConsumers notified Jun 25, 2026 → AG copy submitted Jun 26, 20261d ✓ CA AG copy ≤15d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

May 27, 2026

Begins

Jun 26, 2026

Filed

This filing is one of 5 about the same incident.View merged incident

Part of ORACLE CORPORATION supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Texas State AGbd_57613ef9a6acc1732026-06-26Candidate
Vermont State AGbd_7e1d6bbb8145148c2026-06-27 · +1dVerified
Nebraska State AGbd_b539ee81329b93e32026-06-25 · +1dVerified
Indiana State AGbd_e41b1e0ee313e7242026-06-25 · +1dVerified

Name: NISSAN NORTH AMERICA, INC.
norm: nissan north america

Name: NISSAN NORTH AMERICA, INC.
norm: nissan north america
Industry: Manufacturingllm

Discovered: —
Breach occurred: May 27, 2026 – Jun 9, 2026
Materiality determined: —
Notification sent: Jun 25, 2026
Affected individuals: Not disclosed
Data types: Government IDFinancial accountIdentity (basic)Employment
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
Threat actor: External
Regulator citations: In communication with authorities throughout our response to this attack
Third party: via Oracle
Initial access: supply_chain

During the incident: Activated incident response protocols
Engaged cybersecurity experts
Secured affected systems
Working with Oracle to address this issue
Making arrangements for a free credit or dark web monitoring service offer to affected individuals where available
Implementing additional layers of identity authentication before processing payroll requests
Changes made: Implementing additional layers of identity authentication before processing payroll requests
Source: Quoted from the filing itself, not independently verified.

Compliance flags: CA AG copy ≤15d · 1d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Consumers notified: Jun 25, 2026
→ AG copy submitted: Jun 26, 2026
1d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Consumers notified: Jun 25, 2026 → AG copy submitted: Jun 26, 2026	1d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Nebraska State AGJun 25 · first

Indiana State AGJun 25 · first

Texas State AG+1d

California State AG+1d · this page

Vermont State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-625558
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 26, 2026
Raw hash: 35118874142d253e7597e8a09e4a94a9566e103ccc31cf8ac49c58664e801bf7

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityNISSAN NORTH AMERICA, INC.

Victim entityNISSAN NORTH AMERICA, INC.

IncidentThird-Party / Supply Chain

Stated responseActivated incident response protocols

ComplianceCA AG copy ≤15d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov