Nissan North America has announced that a data breach it suffered last year resulted in the data of more than 53,000 employees being exposed.
The attack, which occurred in November last year, occurred as a result of a threat actor targeting its external VPN and shutting down some of the company’s systems, which it then held for ransom.
Nissan also revealed that none of the systems were encrypted and that the threat actor had accessed a series of files containing what it determined was largely business data.
However, the automaker discovered in February that the data accessed by the hacker included sensitive information belonging to current and former employees.
In a statement sent to those affected, dated May 15, 2024, Nissan revealed that personnel data had been compromised and added that there is no evidence that it had been misused.
“Nissan has been reviewing the compromised data and recently discovered files containing some personal information of our employees,” he said.
“At this time, we have no indication that any information was misused or targeted by an unauthorized actor.”
In a notification to the Maine Attorney General’s Office, Nissan said the data accessed included personal identifiers such as names and social security numbers.
“The data accessed did not include any financial information,” Nissan said.
Following the breach, Nissan said it hired cybersecurity experts to help review its cyber standards and is strengthening its security protocols to prevent a repeat of the event.
“While we are not aware of any cases of fraud or identity theft resulting from this incident, out of an abundance of caution, we are providing you with access, free of charge, to Experian’s IdentityWorks services,” Nissan said.
News of the attack on Nissan North America comes months after Nissan Oceania revealed that an attack on its IT systems resulted in approximately 100,000 people being affected.
“We now know that the list of affected people includes some of Nissan’s customers (including customers of our Mitsubishi, Renault, Skyline, Infiniti, LDV and RAM branded finance businesses), dealers and some current and former employees,” he said.
“Nissan expects to formally notify approximately 100,000 people about the cyber breach in the coming weeks.”
Despite the huge number, Nissan hopes that the number of people affected will reduce due to duplicate lists.
Nissan said the data stolen by the hackers includes Medicare cards, driver’s licenses, passports, tax return numbers, transaction statements, dates of birth and salary information.
“Current estimates indicate that up to 10 percent of people have had some form of government identification compromised,” he added.
“The data set includes approximately 4,000 Medicare cards, 7,500 driver’s licenses, 220 passports and 1,300 tax return numbers.
“The remaining 90 percent of people notified were affected by some other type of personal information, including copies of loan-related transaction statements for loan accounts, employment or salary information, or general information such as dates of birth.”
While Nissan has not acknowledged the threat actor behind the breach, the attack was claimed by the Akira ransomware gang, which claimed to have stolen 100 gigabytes of data from the company.
“We have obtained 100 GB of data from Nissan Australia,” the group wrote on December 22.
“It seems like they are not very interested in the data, so we will upload it in a few days. You will find documents with personal information of your employees in the archives and many other interesting things such as confidentiality agreements, projects, information about clients and partners, etc.
“By the way, there is a notice on your website about the investigation into a possible leak of personal information, so we will confirm it with the data upload.”
