Nissan was targeted by a ransomware attack in December 2023, impacting approximately 100,000 individuals within Nissan Oceania’s systems.
On December 5, 2023, attackers got access to Nissan’s corporate and financial departments via cyberattacks on December 5. On March 13th, 2024, the company issued an update claiming that the matter had been resolved quickly. Before shutting down the breach, the attackers stole a huge amount of sensitive data.
Nissan said that it is investigating a cyberattack on its systems that has affected distribution, marketing, sales, and service activities in Australia and New Zealand. At the time, Nissan denied a data breach, but it strongly advised its customers to monitor their accounts closely and be on the lookout for any potential fraud attempts.
The Akira ransomware group made an unusual entry two weeks after the attack and took credit for it. They claimed to have stolen over 100GB of data, which included private project details, personnel records, non-disclosure agreements (NDAs), and even partner and customer lists.
The disclosure of personally identifiable information (PII) puts people at significant risk. Scammers can utilise stolen data, such as names and driver’s licence numbers, to commit identity theft.
Nissan claims that the impact was not equal for every person affected. Approximately 10%, or roughly 10,000 people, had their government-issued IDs revealed. Additionally, the attackers obtained 4,000 Medicare cards, 7,500 driver’s licenses, 220 passports, and 1,300 tax file numbers.
According to Nissan report:
Nissan expects to formally notify approximately 100,000 individuals about the cyber breach over the coming weeks. The type of information involved will be different for each person. Current estimates are that up to 10% of individuals have had some form of government identification compromised,” continues Nissan’s statement.
Nissan pledged to notify vulnerable users personally, outlining the precise information that was exposed, what steps they may take to protect themselves, and what assistance alternatives are available.
This Japanese automaker has been the subject of many cyberattacks during the last ten years. These events include a data breach that exposed over a million customer details, a source code leak, and a possible hack aimed against their electric vehicles.
A security breach at Nissan North America in January 2021 made the source code for their internal software and mobile apps public. A web-based vulnerability exposed a misconfigured Git server, a service used by engineers to log code changes. This implied that anybody could access the code by just logging in using the default admin/admin credentials.
Nissan provides free credit monitoring services through Equifax in Australia and Centrix in New Zealand, as well as free access to IDCARE, in terms of supporting impacted clients. In addition, replacement government IDs that have been compromised are replaced.
Also, the automobile company advises consumers to monitor their accounts closely for any unusual activity and to notify the authorities immediately. They should enable multi-factor authentication when available and keep their passwords up to date.
In this digital age, it is important to encrypt personal data on drives. This security measure assures that even if unauthorised persons obtain access, they only have access to encrypted data that they cannot decode.
Phishing Tackle offers a free 14-day trial to help train your users to avoid these types of attacks and test their knowledge with simulated attacks using various attack vectors. By focusing on training your users to spot these types of attacks, rather than relying solely on technology, you can ensure that your organisation is better prepared to defend against cyber threats and minimise the impact of any successful attacks.
