NAIC Confirms ShinyHunters Cyberattack as Stolen Insurance Regulator Data Published Online

The National Association of Insurance Commissioners (NAIC) — the standard-setting body that supports insurance regulators across all 50 US states — has confirmed it was the victim of a significant cyberattack, with stolen data now published online by the threat actor responsible. The intrusion was identified on June 11, 2026, and publicly disclosed beginning June 17, with the NAIC providing a series of updates through late June.

The breach was carried out via a critical zero-day vulnerability in Oracle PeopleSoft (tracked as CVE-2026-35273), an unauthenticated remote code execution flaw carrying a maximum-severity CVSS score of 9.8 out of 10. The flaw was actively exploited for roughly two weeks before Oracle published any official advisory on June 10. The NAIC said the attack was part of a broad criminal campaign that struck more than 100 organizations worldwide. The ransomware group ShinyHunters claimed responsibility, alleging it stole 3.1 terabytes of data — more than 105,000 files — and posted the material on its leak site after the NAIC apparently did not meet a June 22 extortion deadline.

ShinyHunters claimed access to key NAIC regulatory technology including the System for Electronic Rate and Form Filing (SERFF), the Online Premium Tax for Insurance (OPTins), the Uniform Certificate of Authority Application (UCAA), the Enterprise Data Platform (EDP), and the Regulatory Data Collection (RDC). However, the NAIC said outside cybersecurity experts confirmed these regulatory reporting systems were not compromised. The organization stated that no personally identifiable information, payment data, employee personal data, electronic funds transfer information, risk-based capital data, policyholder information, or producer data was accessed. The NAIC said it does not believe the group holds the volume or scope of data it has publicly claimed.

One operational impact remains active: certain credit rating agencies paused their data feeds following the incident, leading the NAIC to temporarily suspend assigning designations to insurer investments — a process used in determining the financial health and capital treatment of insurer portfolios. The FBI is coordinating on the investigation. The National Association of Mutual Insurance Companies (NAMIC) criticized the NAIC's communication timeline, noting the gap between the June 11 discovery and the first June 17 public post, and called for an assessment of concentration risk given the volume of sensitive industry data the NAIC holds.