Everest Group Claims Massive Nissan Data Breach, Over 100,000 PayPal Credentials Leaked
Published on January 12, 2026
Key Takeaways
- Threat Actor Claim: The Everest hacking group has claimed responsibility for a cyberattack against Nissan Motor Co., Ltd.
- Data Exfiltration Allegations: The group alleges it has exfiltrated 900 GB of sensitive data from the automotive manufacturer's systems.
- PayPal Allegations: Meanwhile, a hacking forum post shared an alleged PayPal combolist containing over 100,000 lines.
The Everest hacking group has publicly claimed it has breached Nissan Motor Co., Ltd.'s network. In a statement observed on January 10, 2026, the threat actors asserted they successfully exfiltrated a substantial volume of data, estimated at 900 GB. Around the same time, a cybercriminal claimed on a hacking forum that they leaked over 100,000 PayPal email and password combinations.
Nissan Data Breach
Everest has reportedly provided samples of the stolen data to substantiate their claims, which are currently pending verification. The post said the dataset contains TXT, XLS, and CSV files, as well as ZIP archives.
The Nissan claim comes shortly after the carmaker disclosed a separate data breach in December 2025. In that incident, a server managed by a third-party vendor, Red Hat, was compromised, exposing personal customer information but no financial details.
Separately, the carmaker may have been affected by the recent cyberattack on Yazaki Group, a major automotive supplier, for which INC Ransom claimed responsibility. However, it is yet unknown whether the threat actor's claim is related to the confirmed breach.
2026 PayPal Breach Allegations
On January 11, a threat actor using the alias Lud leaked a combolist containing 104,472 lines that reportedly concern PayPal customer credentials from an alleged breach dating back to December 2025.
While this claim is pending verification, TechNadu reported last month that the PayPal subscription feature was being abused in a sophisticated phishing campaign that sent emails from legitimate PayPal addresses, bypassing standard spam filters.
In August 2025, a hacker announced on a dark web forum the sale of a dataset reportedly containing 15.8 million PayPal user accounts with their plaintext passwords.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular