Loading story…
Mazda Motor Corporation disclosed that attackers gained unauthorized external access to an internal warehouse management system used for parts procured from Thailand, exposing 692 records tied to employees, group company staff, and business partners. The company said the intrusion was detected in mid-December 2025 and traced to exploitation of an unpatched vulnerability in the affected system. Exposed information may have included user IDs, full names, email addresses, company names, and business partner IDs, while Mazda said no customer personal data was stored in the compromised environment.
Mazda reported the incident to Japan’s Personal Information Protection Commission, investigated the breach with external cybersecurity specialists, and publicly disclosed the matter after completing its review. The automaker said it has patched the system, revised architecture, reduced internet exposure, restricted source IP access, strengthened monitoring, and tightened access controls, with plans to apply similar protections elsewhere. Although Mazda said it has not confirmed misuse of the data or other secondary damage, it warned affected individuals about elevated risks including phishing, business email compromise, and targeted spam.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Following the investigation and disclosure, Mazda said it patched the affected system, reduced its internet exposure, restricted source IP access, strengthened monitoring, tightened access controls, and revised system architecture. The company also said it plans to extend similar protections to related systems.
On 2026-03-19, Mazda publicly disclosed the security incident, stating that exposed information may have included user IDs, names, email addresses, company names, and business partner IDs. The company said it had not confirmed secondary misuse of the data but warned affected individuals about phishing, scams, and business email compromise risks.
After detecting the incident, Mazda investigated with the help of an external cybersecurity specialist and reported the breach to Japan’s Personal Information Protection Commission. The company determined that 692 records tied to employees, group company staff, and business partners may have been exposed, with no customer data involved.
In mid-December 2025, Mazda detected unauthorized external access to an internal warehouse management system used for parts procured from Thailand. The intrusion was later attributed to exploitation of unpatched vulnerabilities in the system.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceteiss.co.uk
Open sourcebleepingcomputer.com
Open sourcelinkedin.com
Open sourcenewsroom.mazda.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kubota North America Corporation disclosed that an unidentified threat actor had access to parts of its network from **March 16 to April 20** and accessed files containing sensitive personal information tied to employees and their dependents. The company said it determined on **June 16** that one or more human-resources files may have been viewed during the intrusion, with exposed data potentially including names, Social Security numbers, dates of birth, taxpayer identification numbers, driver's license or other government ID numbers, direct-deposit bank account information, corporate payment card details, benefits enrollment data, and limited claims information. Kubota began sending individualized breach notifications on **June 30** and is offering affected people **Kroll identity protection services**. The company said it has implemented additional security measures following the incident and reported **no known operational or business disruption**. As of publication, no ransomware or data-extortion group had publicly claimed responsibility for the breach.
Jul 2, 2026
Nissan Motor Co. confirmed that personal data of approximately 21,000 customers was compromised following unauthorized access to a Red Hat-managed server. The breach, detected in September, affected customers who purchased vehicles or received services at the former Nissan Fukuoka Motor Co. (now Nissan Fukuoka Sales Co.), exposing names, addresses, phone numbers, partial or full email addresses, and other sales-related customer information. No credit card or financial data was reported stolen, and Nissan has stated there is no evidence the leaked information has been misused, though customers are advised to remain vigilant for potential phishing or fraud attempts. The incident originated from a breach of a dedicated GitLab instance managed by Red Hat Consulting, with the intrusion detected by Red Hat on September 26 and Nissan notified on October 3. The Crimson Collective threat actor initially claimed responsibility for the theft of hundreds of gigabytes of data from 28,000 private GitLab repositories, with ShinyHunters later hosting samples of the stolen data on their extortion platform. Nissan has apologized for the incident and pledged to strengthen monitoring of subcontractors and enhance information security measures in response to the breach.
Jun 29, 2026
Data allegedly sourced from US automotive retailer **CarMax** was published online after a **failed extortion attempt**, according to a Have I Been Pwned breach entry. The exposed dataset reportedly includes **431,000 unique email addresses** along with **names, phone numbers, and physical addresses**, indicating a PII-heavy leak that could enable targeted phishing and identity-focused fraud. Separately, **CarGurus** was reported as being purportedly breached by the **ShinyHunters** hacking operation, with claims of **1.7 million corporate files** stolen and an extortion deadline tied to negotiations. The intrusion was alleged to have occurred via **single sign-on (SSO) codes obtained through voice phishing**, consistent with ShinyHunters’ prior claims of compromising other organizations using SSO-code access; CarGurus has been positioned as another extortion-driven theft where internal records and PII may be at risk of exposure.
Jun 29, 2026