Nissan attack exposes sensitive data of thousands
Japanese carmaker Nissan has experienced a cyberattack against its North American subsidiary, which revealed the sensitive data of over 53,000 employees alongside business information.
Image by Shutterstock.
Japanese carmaker Nissan has experienced a cyberattack against its North American subsidiary, which revealed the sensitive data of over 53,000 employees alongside business information.
The impacted employee data that may have been “accessed, viewed, or removed” includes:
- Names and other personal identifiers
- Social Security numbers
The business information accessed by the threat actor remains unknown. Cybernews has reached out to Nissan North America for comment.
Nissan North America (NNA) claims to have learned of the targeted attack on its external VPN on November 7th, 2023, when “a criminal threat actor deliberately shut down certain NNA systems and demanded ransom.”
More from Cybernews
Sainsbury’s installs more facial rec tech in stores: Should shoppers be worried?
"Phantom squatting” uses AI hallucinated domains for cyber attacks
What they’re doing to gamers is a robbery in broad daylight
Irish parliament expands Microsoft use, despite the EU’s efforts to ditch it
Can government AI actually scrub UAP footage from the internet?
The EU and Apple CEO Tim Cook held "constructive" talks after their Siri AI dispute in Europe
Unlike conventional ransomware schemes, the threat actor supposedly did not encrypt any data or render any of the NNA’s systems inoperable. Despite the prior statement explaining that a threat actor shut down certain NNA systems.
In a breach notification letter filed to The Office of the Maine Attorney General by an attorney on behalf of Nissan, the automaker shared that a “criminal threat actor accessed data from a number of NNA’s local network shares.”
In December 2023, NNA told all current employees about the incident and informed them that certain employee information may have been accessed.
During the investigation, NNA found that “nearly all implicated data was business information and did not contain personal information.”
However, on February 28th, 2023, NNA found that certain personal information in the data related primarily to former and current employees.
“At this time, NNA has no indication that any information has been misused or was the attack's intended target,” Nissan said.
Since the cyberattack, the NNA has “taken several steps to strengthen its security environment, including an enterprise-wide password reset, implementation of Carbon Black monitoring on all compatible systems, vulnerability scans, and other actions to address unauthorized access.”
Nissan is providing all those affected with Experian’s IdentityWorks services and “proactive fraud assistance” if any of them become a victim of fraud.
This isn’t the first cybersecurity incident to affect Nissan. The Japanese auto giant said the company was investigating the extent of a cyber incident that impacted Nissan’s Oceania businesses back in December and was subsequently claimed by Akira, a well-known ransomware cartel.