Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Data Breaches

25k Nissan Customers Affected by Data Breach at Third-Party Software Developer

Nissan North America told roughly 25,000 customers that their personal information was exposed in a data breach via a third-party provider.

Nissan North America is informing roughly 25,000 customers that their personal information was exposed in a data breach at a third-party services provider.

The breach occurred after data provided by Nissan to the services provider was inadvertently exposed on the internet, the company notes in a notification letter sent to the impacted customers.

“The impacted third-party service provider provides software development services to Nissan. Nissan provided certain information to this service provider for processing during the testing of the software,” the car maker says.

According to Nissan, the services provider temporarily stored Nissan-provided data in a cloud-based public repository.

The company was informed of the incident in June 2022. In September, its investigation into the data breach determined that some personal information belonging to Nissan customers was accessed and exfiltrated from the repository.

The compromised information, Nissan says, includes names, birth dates, and NMAC account numbers. The breach did not include Social Security numbers and credit card information.

“Upon learning of this issue, we immediately ensured that the third-party provider contained the threat by disabling all unauthorized access to the data, and we commenced a prompt and thorough investigation,” Nissan says.

The company also notes that it has no evidence that the exposed data has been misused. However, it’s not uncommon for stolen personal information to be shared on hacker forums and to be later used in phishing and other types of cyberattacks.

While the notification letter does not say how many customers were impacted, Nissan told the Maine Attorney General’s Office that 25,000 individuals were affected.

Nissan North America, or Nissan USA, is a wholly owned subsidiary of Japanese car maker Nissan Motor Corporation, manufacturing and selling Nissan and Infiniti vehicles through a network of over 1,000 Nissan and 200 Infiniti dealers in the US.

*updated on February 7 to reflect Nissan’s updated number of impacted individuals from 18,000 to 25,000

Related: 16 Car Makers and Their Vehicles Hacked via Telematics, APIs, Infrastructure

Related: Tesla Returns as Pwn2Own Hacker Takeover Target

Related: US Subsidiary of Automotive Hose Maker Nichirin Hit by Ransomware

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.

Register

Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.

Register

Expert Insights

Related Content

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Data Breaches

A group of hackers has leaked Atlassian employee records and floorplans, information that was obtained from third-party workplace platform Envoy.

ICS/OT

The overall effect of current global geopolitical conditions is that nation states have a greater incentive to target the ICS/OT of critical industries, while...

Cybercrime

Instant Checkmate and TruthFinder have disclosed data breaches affecting a total of more than 20 million users.

Data Breaches

AT&T is notifying millions of wireless customers that their CPNI was compromised in a data breach at a third-party vendor.