Nissan has confirmed that customer information was exposed following unauthorized access to an environment operated by a vendor working on a dealer customer management system. The disclosure was posted on Nissan’s Japanese website and attributes the incident to a breach reported by Red Hat, which was providing services to Nissan Fukuoka Sales Co., Ltd.
According to Nissan’s notice, Red Hat informed the company that unauthorized access had occurred within an environment used in connection with the dealer system, resulting in the leakage of some customer information. Nissan’s statement specifies that the affected data relates to customers of Nissan Fukuoka Sales Co., Ltd., and does not describe the incident as impacting Nissan’s broader corporate systems.
Japanese security and industry reporting has identified the affected system as a self-managed GitLab instance used by Red Hat consultants during development work. These reports estimate the impacted population at approximately 21,000 customers and describe exposed information as including customer contact details and internal sales or service notes. Secondary reporting consistently states that payment card information was not included in the exposed data, though Nissan’s own notice does not enumerate specific data fields.
Nissan’s disclosure frames the incident as originating from a vendor environment rather than Nissan infrastructure. The company’s notice includes an apology and states that measures have been taken to prevent recurrence, though it does not detail technical remediation steps. The notice also references customer communication and support channels for affected individuals.
The incident highlights the role of third-party development and collaboration platforms in data exposure events. Environments used for application development or system integration can contain production or near-production data, creating downstream customer impact when access controls fail or credentials are compromised.
Nissan’s statement does not indicate evidence of misuse of the leaked information at the time of publication. The company has limited the scope of the incident to a specific dealer entity and system.
Sources: Nissan, CCSI, Blackhat News Tokyo
—
By Ji-seo Kim
