Nissan Oceania is alerting approximately 100,000 individuals of a data breach resulting from a ransomware attack by a known cybercrime group in late 2023. The carmaker detected an intrusion on December 5, 2023, and informed customers about the incident the same day. The attack impacted Nissan Motor Corporation and Nissan Financial Services in Australia and New Zealand.
The Akira ransomware group later claimed responsibility for the attack, stating that they had stolen 100 GB of information from the company, including corporate files and personal data. The hackers have since published files allegedly stolen from Nissan systems, indicating that the car manufacturer refused to comply with ransom demands.
In a recent update, Nissan Oceania stated that it has begun contacting affected individuals. Following an investigation with the help of government authorities and external cybersecurity experts, the company found that the data breach impacts some Nissan customers, dealers, as well as current and former employees. Customers of Mitsubishi, Renault, Skyline, Infiniti, LDV, and RAM branded finance businesses are also affected.
Nissan estimates that around 100,000 people will need to be notified, although the actual number might be lower once contact details are validated and duplicate entries are removed. The company stated, “The type of information involved will be different for each person. Current estimates are that up to 10% of individuals have had some form of government identification compromised. The data set includes approximately 4,000 Medicare cards, 7,500 driver’s licenses, 220 passports, and 1,300 tax file numbers.”
For the remaining 90% of individuals being notified, their personal information has been impacted in other ways, such as copies of loan-related transaction statements for loan accounts, employment or salary information, or general information like dates of birth.
Affected individuals are being offered free identity theft and credit monitoring services. Nissan is also reimbursing those who need to replace their government ID due to the incident.
