One hidden Oracle flaw, hundreds of breached companies — and Nissan is just the biggest name

Cybersecurity 4 min 34 sources

A flaw in the payroll software that runs much of corporate HR was attacked before Oracle even knew it existed. Nissan, Aflac Japan, universities and US insurance regulators are among the hundreds now counting the damage.

Key takeaways

Attackers broke into hundreds of companies through hidden flaws in Oracle's payroll and payments software — Nissan, Aflac Japan and US insurance regulators are among the named victims.
Some flaws were zero-days, unknown even to Oracle when the attacks started; the emergency patches came out only after the damage was done.
A patch fixes the hole, but it can't retrieve data already stolen — which is why the window between an attack starting and a fix landing is the whole game.

The same week Oracle shipped its first-ever monthly security patch, attackers were already inside hundreds of the companies it was meant to protect.

One flaw, hundreds of victims

Nissan told regulators that current and former employees may have had their most sensitive records stolen — Social Security numbers, banking details, tax data, national ID numbers — after attackers broke into Oracle’s PeopleSoft software [2]. PeopleSoft is the enterprise system the carmaker uses to run payroll and HR, so it holds exactly the data a thief wants [2]. The flaw, tracked as CVE-2026-35273, is a critical bug that lets an attacker run their own code on the server [2].

Here’s the part that matters: it was a zero-day — a flaw the software maker doesn’t yet know about, so there’s no patch, and attackers using it have a clear run until it’s found and fixed [2]. Oracle issued an emergency advisory and mitigations only after the attacks began [2]. Nissan pinned the break-in to a window between May 27 and June 9 [2].

Nissan wasn’t singled out. Oracle warned it that the same campaign had hit “hundreds of companies,” and the wave has been linked to an extortion crew calling itself ShinyHunters, which claimed to have breached more than 100 organisations, mostly universities [2]. One data-security executive called it “a mass-casualty event across hundreds of unrelated organizations,” and made the point that stings most: patching the flaw does nothing for data already taken during the window it was open [2].

What to do if you’re an affected employee or customer: watch for phishing emails that name your employer, change any password you reused elsewhere, and turn on multi-factor authentication — a second check beyond your password — wherever you can [2]. Nissan has locked payroll changes behind extra identity checks as a precaution, and is offering staff free credit and dark-web monitoring [2].

The same vendor, a second front

While the PeopleSoft story unfolded, a separate Oracle product came under fire. Attackers began exploiting a critical flaw in Oracle’s E-Business Suite — CVE-2026-46817, rated 9.8 out of 10 — that lets an unauthenticated stranger take over the Payments module over the web [3]. Oracle had actually fixed this one in late May, as part of that first monthly patch round that closed 77 separate holes [3]. The break-ins started anyway [3], for the oldest reason in security: a patch only protects the machines that install it, and many hadn’t.

The list of PeopleSoft victims kept growing. Aflac’s Japan arm said hackers reached its policyholder portal repeatedly between June 15 and June 25, exposing data on 4.38 million people [9]. US state insurance regulators were caught in the same campaign [9]. The pattern is consistent: one flaw in software that sits underneath thousands of organisations, and each of them becomes a separate breach.

The rest of the board

A few other things moved worth knowing about:

Citrix patched a new flaw in its NetScaler networking gear, CVE-2026-8451, that researchers say echoes “CitrixBleed” — an earlier bug that leaked the digital session keys attackers use to walk straight past login screens [5]. No confirmed exploitation yet, but its ancestors were weaponised in ransomware campaigns, so applying the fix quickly is the sane move [5].
Ransomware is now an industry, not a hobby. More than 300 UK firms reported ransomware attacks in a single year [10]. Analysts who read leaked chat logs from the Black Basta gang found it ran like a company — a call team on a fixed 6pm-to-2am shift, outsourced malware and spam services, wages tied to performance reviews [6]. Before shutting in 2025 it hit 520 victims across 39 industries and collected at least $107 million [6]. Ransomware overall is now reckoned a $74 billion-a-year global business [6].
Healthcare is taking the brunt. One vendor’s sensors on UK healthcare networks logged 264,000 intrusion attempts in the first five months of 2026 — against 27,000 for all of 2025, a tenfold jump [1].

What we still don’t know

The full count of PeopleSoft victims is unconfirmed — “hundreds” is Oracle’s word, and named victims so far skew toward universities, with Nissan among the larger corporate names [2]. ShinyHunters’ claims of 100-plus breaches are the attacker’s own count and haven’t been independently verified [2]. And for anyone already exposed, the honest answer is that a patch fixes the door, not the data that already left through it [2].

02 · Lesson · why it matters

The lock that only gets installed after the burglar has left

A patch can only be written once a flaw is known — so for every hole, there is a stretch of time when it is wide open and no one is guarding it. That gap, not the hole itself, is where the damage happens.

The strange order of events

Read the Nissan story slowly and something odd stands out. The attackers were inside the software before Oracle knew there was a way in. Oracle’s warning, its emergency advisory, its fix — all of it came afterward. By the time the door had a lock, the thieves were already gone with the payroll files.

This is not a story about one careless company. It is a story about the order in which things happen in security, and why that order almost always favours the attacker.

Why the defender is always second

A patch is a repair. You cannot repair a hole you don’t know exists. So the sequence is fixed: someone finds a flaw, someone exploits it, and only then does anyone write the fix. The word for a flaw the maker doesn’t yet know about is a zero-day — zero being the number of days the defender has had to prepare. There is no patch, because there is nothing yet to patch against.

Think about what that means. The attacker moves first, in silence, on their own clock. The defender moves second, in public, reacting. Security marketing loves the image of a wall — high, solid, keeping bad things out. But a wall is built before the enemy arrives. A patch is built after. The whole model runs a step behind, by design, because you cannot defend against a break-in you haven’t discovered yet.

This is why one security expert’s line about the Oracle breach cut so deep. Patching the flaw, he said, does nothing for the data already taken. The fix protects the next company. For the ones already hit, it arrives at the scene of a robbery that finished weeks ago.

The same flaw, all at once

Now notice how far the blast travels. It was not just Nissan. The same Oracle software runs payroll and HR at hundreds of organisations — carmakers, universities, an insurance giant in Japan with 4.38 million customers, the regulators who oversee US insurers. One flaw, and every one of them became a separate break-in, on roughly the same days.

They look like unrelated victims. They are really one victim, refracted. What connected them was not a shared enemy but a shared floor — the same piece of software sitting underneath all of them, holding the same kind of data. When the floor cracks, everyone standing on it falls at once. This is the quiet arithmetic of shared infrastructure: the thing that makes it cheap and convenient — everyone uses the same trusted system — is exactly the thing that makes one flaw catastrophic instead of local.

You are standing on that floor

Here is the part that reaches past the headline. Your Social Security number, your bank details, your tax records — for a great many people, those don’t live somewhere you chose. They live in software your employer bought, or your insurer runs, or your government uses. You never picked it. You cannot patch it. You will not even know its name until the breach letter arrives.

That is the honest, uncomfortable shape of it. The advice we all repeat — use a strong password, turn on the second check, watch for phishing — is real and worth doing. But it guards the front door of your account. It does nothing about the flaw sitting three companies away, in a system you’ve never heard of, that happens to hold a copy of your life. Most of the exposure you carry is out of your hands, decided by choices made in rooms you were never in.

What the shape asks of us

None of this means the defenders are fools or the vendors are villains. Oracle shipped its first-ever monthly patch cycle the same month all this broke — a genuine attempt to close holes faster. But faster is still second. The structure itself — find, exploit, then fix — hands the attacker the opening move, and no amount of diligence changes whose turn comes first.

So the useful thing to carry isn’t fear, and it isn’t a false sense of control. It’s a more honest picture of the ground you stand on. Security isn’t a wall you finish building. It’s a race run one lap behind, where the best anyone can do is shorten the gap between the break-in and the fix — and where a lot of what protects you was decided by people you’ll never meet, in software you’ll never see. Knowing that doesn’t make you safer today. But it makes you a little less surprised, and a little humbler about how much of your own safety is actually in your hands.

03 · Lab · your turn

The Window Before The Fix

Rehearse a defender's only real choice against a zero-day: not whether data is taken, but how far you can shrink the window before the door gets locked.

04 · Hope · carry this

The same month these break-ins landed, Oracle moved to patching every month instead of every few — a quiet admission that the window between a flaw and its fix is worth racing to close. Defenders are always a step behind, but they keep making that step shorter, and that steady narrowing is progress you can count on even when no single day feels safe.