Nissan's PeopleSoft breach and the data People and Payroll own

Being current and supported did not protect Nissan.

Nissan has disclosed an employee data breach linked to Oracle PeopleSoft. The exposed data reportedly covers current and former employees, including bank, tax and identity details.

Attackers got in before Oracle could ship a fix, and around 100 organisations were caught in the same campaign. Patching was never going to stop it in time.

If the problem can't be solved by the software vendor's patching, the exposure is set earlier, by what data the platform holds and who it holds it about. That part sits with People and Payroll, not IT.

So the questions worth asking now are about data. Why does the platform still hold bank and tax details for former employees across multiple countries? And if it were breached tomorrow, how quickly could you say whose data was exposed, in which jurisdictions, and what you owe those people?

IT and security own the platform's defences. People and Payroll own what sits inside it, and how far back it reaches.

Reducing what the platform holds, and being sure it's appropriate, is worth your time.