Insurance
Home›Insurance›Industry & Deals›NAIC extends private-rating filing deadlines after Jun…
NAIC extends private-rating filing deadlines after June cyberattack
The deadline extension covers the outage period that began June 17, and the NAIC said it resumed full data feeds after providers restarted sharing information.
The National Association of Insurance Commissioners has approved a temporary extension for private-rating filing deadlines for its VISION system, aiming to restore the timeline for insurers affected by a June data breach disruption. The extension covers a period equal to the length of the outage, which the NAIC said began June 17 and has already been implemented in the filing application, according to Insurance Business.
The NAIC says its Securities Valuation Office uses the credit quality assessments it produces, including NAIC designations, for state-regulated insurers to complete statutory financial reporting. The disruption followed the NAIC detecting unauthorized access to its Oracle PeopleSoft system on June 11, which it confirmed publicly on June 23, and credit rating providers paused data feeds shortly after the incident came to light.
Insurance Business reports that the NAIC temporarily suspended assigning new designations starting June 18 after providers stopped sharing data. The organization later said in mid-August that data sharing had resumed, and it confirmed it is now receiving the feeds needed to assign designations based on both public and private credit rating determinations.
The breach was linked to a critical Oracle PeopleSoft vulnerability, tracked as CVE-2026-35273, with a maximum severity score of 9.8 out of 10 that can be exploited remotely without authentication. The NAIC said Oracle did not publish a security advisory until June 10, while it also reported that its investigation with outside cybersecurity experts and the FBI found the extortion group ShinyHunters did not gain the broader access the group claimed, and that the accessed data was limited to statutory financial reporting.