Reported by 1 outlet
NAIC Suspends Investment Risk Designations After 3.1TB Data Breach — ShinyHunters Behind Oracle PeopleSoft Attack
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 1.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
NAIC Suspends Investment Risk Designations After 3.1TB Data Breach — ShinyHunters Behind Oracle PeopleSoft Attack
databreaches.net · 109d ago · June 27th, 2026
The National Association of Insurance Commissioners (NAIC), the U.S. insurance industry's standard-setting and regulatory support organization, has suspended assigning risk designations to insurers' investments after a cyberattack on its Oracle PeopleSoft systems. Credit rating agencies paused data sharing with NAIC following the breach, which resulted in 3.1TB of data exfiltration.
The breach — identified June 11 and publicly announced June 23 — was attributed to the ShinyHunters extortion group exploiting an Oracle PeopleSoft zero-day (CVE-2026-17435). The operational disruption goes beyond data theft: NAIC's Securities Valuation Office (SVO) risk designations are used by state insurance regulators to assess insurer solvency. The suspension means new investment classifications are delayed, which may cascade into insurance company portfolio reporting requirements across all 50 states.