Nissan data breach exposed Social Security numbers of thousands of employees

Nissan suffered a data breach last November in a ransomware attack that exposed the Social Security numbers of thousands of former and current employees, the Japanese automaker said Wednesday. 

Nissan’s U.S.-based subsidiary, Nissan North America, detailed the cyberattack in a May 15 letter to affected individuals. In the letter, Nissan North America said a bad actor attacked a company virtual private network and demanded payment. Nissan did not indicate whether it paid the ransom. 

“[U]pon learning of the attack, Nissan promptly notified law enforcement and began taking immediate actions to investigate, contain and successfully terminate the threat,” the car maker said in the letter, adding that “Nissan worked very closely with external cybersecurity professionals experienced in handling these types of complex security incidents.”

Nissan told employees about the incident during a town hall meeting in December 2023, a month after the attack. The company also told staffers that it was launching an investigation and would notify employees privately if their personal information had been compromised. Nissan said it’s providing free identity theft protection services to impacted individuals for two years. 

Nissan North America also notified state officials across the U.S. of the attack, noting that data belonging to more than 53,000 current and former workers was compromised. But the company said its investigation found that affected individuals did not have their financial information exposed. 

Nissan North America “has no indication that any information has been misused or was the attack’s intended target,” the automaker said in its letter.

Ransomware attacks, in which cybercriminals disable a target’s computer systems or steal data and then demand payment to restore service, have become increasingly common. One cybersecurity expert said someone likely got a password or multi-factor authentication code from an existing Nissan employee, enabling the hacker to enter through the company’s VPN. 

“It is unfortunate that the breach ended up involving personal information, however Nissan has done the right thing by continuing to investigate the incident and reporting the update,” Erich Kron, a cybersecurity awareness advocate at KnowBe4, told CBS MoneyWatch in an emailed statement. “In this case, targeting the VPN will often help bad actors avoid detection and bypass many of the organizational security controls that are in place.”