Thousands of Nissan customers are learning that some of their personal data was leaked after unauthorized access to a Red Hat-managed server, according to the Japanese automaker.

About 21,000 customers who purchased a vehicle or had service done at the former Nissan Fukuoka Motor Co. (now Nissan Fukuoka Sales Co.) were affected by a digital intrusion detected in September, the company said in a December breach disclosure.

While the crooks reportedly did not steal any credit card information, leaked personal details include customers' addresses, names, phone numbers, partial email addresses, and other customer-related information used for sales activities.

"At this time, there has been no confirmation that the leaked information has been used for secondary purposes," the car manufacturer said in a Japanese-language report translated via Google, adding that customers should be on high alert for suspicious calls or mail - all of these stolen details can be valuable to criminals in targeted phishing attacks or other financial fraud.

"Nissan takes this incident very seriously and will strengthen its monitoring of its subcontractors and take further steps to strengthen information security," the company noted. "We would like to once again offer our deepest apologies to our customers for any inconvenience caused."

The IBM-owned open source software maker previously disclosed that "an unauthorized third party had accessed and copied some data from a Red Hat Consulting-managed, dedicated GitLab instance." 

According to the Nissan breach notification, Red Hat detected the intruders on September 26, and then alerted the automaker on October 3.

Nissan did not immediately respond to The Register's inquiries, including who was responsible for the data theft and whether the criminals had tried to extort the carmaker. We will update this story if we receive a response.

• Red Hat fesses up to GitLab breach after attackers brag of data theft
• Red Hat breach escalates as criminals collaborate on 'multi-terabyte' extortion plot
• Nissan infosec in the spotlight again after breach affecting more than 50K US employees
• Nissan to let 100,000 Aussies and Kiwis know their data was stolen in cyberattack

While neither Nissan nor Red Hat named a specific criminal group in their statements, in early October, a group called Crimson Collective claimed to have broken into Red Hat's private GitLab repositories and exfiltrated some 570 GB of compressed data, including sensitive documents belonging to customers. 

A day later, Red Hat confirmed the breach.

Shortly after, Crimson Collective said it had teamed up with the ShinyHunters-linked "Scattered Lapsus$ Hunters" gang to extort the IBM-owned biz.

This is the auto manufacturer's third major breach in as many years.

In May 2024, Nissan admitted personal information belonging to more than 50,000 of its North American employees, both current and former, had been stolen in a November 2023 "targeted cyber attack."

Two months prior, Nissan disclosed that its Oceania division's IT systems had been hit by the Akira ransomware gang, which stole personal information belonging to more than 100,000 customers. The Akira attack reportedly occurred in December 2023. ®