NAIC Confirms Insurance Regulator Data Stolen in PeopleSoft Hack as ShinyHunters Publishes 3.1TB Online

The body that coordinates US state insurance regulators has become the latest high-profile victim of a sweeping global cyberattack campaign. The National Association of Insurance Commissioners (NAIC) — a nonprofit organization that helps insurance regulators across all 50 states set standards and protect consumers — confirmed on June 25, 2026, that data stolen during a breach of its Oracle PeopleSoft system has been published online by the group responsible.

The NAIC first identified unauthorized access on June 11 and disclosed the incident publicly on June 23. Investigators determined the attacker exploited a critical zero-day vulnerability in Oracle PeopleSoft tracked as CVE-2026-35273 — an unauthenticated remote code execution flaw carrying a maximum-severity CVSS score of 9.8. Oracle did not publish an advisory until June 10, meaning the flaw was actively exploited for roughly two weeks before any official fix existed. The breach was part of a broader criminal campaign that struck more than 100 organizations worldwide.

The extortion group ShinyHunters claimed responsibility, alleging it obtained 3.1 terabytes of data — more than 105,000 files — spanning systems including the statistical INSData platform, credit rating feeds, and various state insurance reporting tools. The group claimed the trove included millions of insurer regulatory filing PDFs and tens of thousands of rating agency files from Moody's, Fitch, S&P, Kroll, DBRS, and AM Best containing CUSIP and ISIN financial identifiers.

The NAIC has pushed back firmly on the scope of these claims. The organization stated that outside cybersecurity experts confirmed key regulatory systems — including SERFF (System for Electronic Rate and Form Filing), OPTins, UCAA, the Enterprise Data Platform, and Regulatory Data Collection — were not compromised. Critically, the NAIC said no personally identifiable information, payment data, credit card or banking details, policyholder information, or producer data was accessed. State insurance departments' own systems were unaffected. As a precaution, certain credit rating agencies paused their data feeds, leading the NAIC to temporarily suspend assigning designations to insurer investments — a process it warned could take months to fully restore. The FBI is coordinating the investigation.