Loading story…
Kubota North America Corporation disclosed that an unidentified threat actor had access to parts of its network from March 16 to April 20 and accessed files containing sensitive personal information tied to employees and their dependents. The company said it determined on June 16 that one or more human-resources files may have been viewed during the intrusion, with exposed data potentially including names, Social Security numbers, dates of birth, taxpayer identification numbers, driver's license or other government ID numbers, direct-deposit bank account information, corporate payment card details, benefits enrollment data, and limited claims information.
Kubota began sending individualized breach notifications on June 30 and is offering affected people Kroll identity protection services. The company said it has implemented additional security measures following the incident and reported no known operational or business disruption. As of publication, no ransomware or data-extortion group had publicly claimed responsibility for the breach.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Kubota began sending individualized notification emails to affected people on June 30, 2026. The company also offered Kroll identity protection services or guidance to impacted individuals.
On June 16, 2026, Kubota determined that one or more human-resources files accessed during the intrusion may have contained sensitive information belonging to certain employees and their dependents. The potentially exposed data included identifiers and financial information.
Kubota reported that the unauthorized access to affected network systems lasted until April 20, 2026. During this period, files containing sensitive employee and dependent information were accessed.
Kubota North America said an unidentified threat actor had access to some of its network systems beginning on March 16, 2026. The intrusion ultimately lasted for more than a month.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mazda Motor Corporation disclosed that attackers gained unauthorized external access to an internal warehouse management system used for parts procured from Thailand, exposing **692 records** tied to employees, group company staff, and business partners. The company said the intrusion was detected in mid-December 2025 and traced to exploitation of an unpatched vulnerability in the affected system. Exposed information may have included user IDs, full names, email addresses, company names, and business partner IDs, while Mazda said **no customer personal data** was stored in the compromised environment. Mazda reported the incident to Japan’s Personal Information Protection Commission, investigated the breach with external cybersecurity specialists, and publicly disclosed the matter after completing its review. The automaker said it has patched the system, revised architecture, reduced internet exposure, restricted source IP access, strengthened monitoring, and tightened access controls, with plans to apply similar protections elsewhere. Although Mazda said it has not confirmed misuse of the data or other secondary damage, it warned affected individuals about elevated risks including **phishing**, **business email compromise**, and targeted spam.
Jun 29, 2026
KDDI disclosed unauthorized access to an email platform it operates for itself and multiple Japanese internet service providers, warning that up to **14.22 million** email account records may have been exposed. The affected service supports KDDI and providers including **STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty, and BIGLOBE**. KDDI said the intrusion was detected on June 17 and linked to exploitation of a vulnerability in third-party software used by the system, after which it blocked further access and added defensive measures. The potentially exposed data includes email addresses, passwords, and some personal information tied to active, dormant, and canceled accounts. KDDI said the password data was hashed or encrypted, but it has not publicly clarified the protection status or algorithms for all records, and the full scope of the incident remains under investigation. The company reported the breach to Japan’s **Personal Information Protection Commission** and the **Ministry of Internal Affairs and Communications**, and is coordinating customer notifications and password resets with the affected ISPs.
Jun 30, 2026
San Jose officials notified current and former city employees that a **USB drive was lost** on Jan. 9 and may have contained sensitive employee data, including **Social Security numbers**; the city has not disclosed how many individuals were affected. Separately, **Conduent Business Services** reported a large-scale compromise in which attackers allegedly accessed its network from **Oct. 21, 2024 to Jan. 13, 2025** and exfiltrated files containing personal and medical data; multiple state-level notices and alerts cited impacts ranging from **10.5 million** individuals (Oregon DOJ alert) to **4 million** residents (Texas), with Conduent stating it has not seen evidence of misuse or public posting to date. In another incident, **Managed Care Advisors / Sedgwick Government Solutions** disclosed a ransomware event affecting a corporate **SFTP server** that stored **PII/PHI**; the company said the intrusion began **Nov. 16, 2025** via exploitation of a vulnerability in the SFTP application, was detected **Dec. 4, 2025**, and resulted in encryption of files on that server only. Sedgwick reported it disabled SFTP connections, restored data from backups the next day, and engaged **Mandiant** for forensic support, stating the investigation found no compromise beyond the single server.
Jul 5, 2026