Harley-Davidson Data Breach

The Cl0p ransomware gang says it attacked Harley-Davidson and posted about 270 GB of the company’s files online. Harley-Davidson has not confirmed a data breach.

What Cl0p Claims About Harley-Davidson

Harley-Davidson, Inc. is the Milwaukee-based motorcycle maker. It sells bikes through a large dealer network and runs a financial services arm that offers loans to riders.

On September 10, 2026, Cl0p added Harley-Davidson to its leak site. A leak site is a dark web page where a criminal group names the companies it says it hacked. Cl0p later marked the company’s files as published through a torrent, a file-sharing method.

Cybernews reported on September 12, 2026 that the listing totals about 270 GB. Cybernews also reported that Cl0p placed Harley-Davidson among companies it said did not contact the group. These are Cl0p’s claims. Harley-Davidson has not confirmed them.

What Harley-Davidson Has Said So Far

A Harley-Davidson spokesperson told Cybernews that the company “is aware of the claims but is declining to comment further at this time.”

That statement does not confirm an attack or a breach. As of October 20, 2026, Harley-Davidson has not posted a Notice of Data Breach. It has not filed a breach report with any state attorney general that Emery | Reddy could find. It has not said whether any customer, employee or dealer information was involved.

How the PTC Windchill Campaign Works

According to Cybernews, the claim is part of a larger Cl0p campaign that began in June 2026. The group used a flaw in PTC Windchill, a program that companies use to manage product designs and engineering files. The flaw, tracked as CVE-2026-12569, let attackers run their own code on a company’s server. It was a “zero-day,” meaning attackers used it before a fix existed. PTC has since released a patch.

Cybernews reported that Cl0p has named dozens of companies in this campaign. The outlet said the folder names it could see in the Harley-Davidson listing pointed to Windchill system files, server logs, settings and backups, plus older Oracle business software logs. Cybernews said it could not verify what the files contain.

What Kinds of Records Could Be at Stake?

No one has confirmed that personal information was involved. Speaking generally, a company like Harley-Davidson keeps several kinds of records:

• Product design and engineering files
• Employee and job applicant records
• Dealer and supplier business records
• Customer contact, purchase and financing records

Which of these, if any, are in the files Cl0p posted is unknown. Cl0p focuses on stealing data rather than locking systems, according to Cybernews.

Steps to Take While the Facts Develop

Even before a company confirms a breach, people with a connection to it can take simple steps:

• Watch the mail and email for a notice letter from Harley-Davidson
• Be wary of emails, texts or calls that mention Harley-Davidson or a breach
• Review bank, card and loan statements for activity you do not recognize
• Consider a free credit freeze with Equifax, Experian and TransUnion

Do You Have Legal Options?

Companies that collect personal information from customers and workers have a legal duty to protect it. They also have a duty to tell people promptly when that information is exposed. If Harley-Davidson confirms that personal information was involved, affected individuals may have legal rights and remedies.

Emery | Reddy is investigating the claimed Harley-Davidson cyberattack. Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. 

FAQ

Has Harley-Davidson confirmed a data breach?

No. As of October 20, 2026, Harley-Davidson has only said it is aware of Cl0p’s claims. It has not confirmed that anyone’s information was taken.

How many people were affected by the Harley-Davidson data breach?

No number has been released. The 270 GB figure is Cl0p’s claimed file size, not a count of people.

Was any personal information involved?

Nothing has been confirmed. Cybernews said the visible folder names point to engineering and system files, but it could not check what the files hold.

Is this the same as the Harley-Davidson hacking claim from early 2025?

No. A different group claimed a hack over the 2024 holidays. In January 2025, Harley-Davidson told Visordown: “We have thoroughly investigated and have not found that the Motor Company has been impacted.” The September 2026 Cl0p claim is a separate matter.

What should I do if I worked for, bought from, or financed a bike through Harley-Davidson?

• Keep an eye out for a notice letter and keep it if one arrives
• Do not click links in messages that mention the claimed attack
• Check your financial accounts and credit reports
• Call Emery | Reddy for a Free Case Review

How do I avoid scams that mention a breach?

Criminals often send fake messages that name a company in the news. Do not click links or open attachments in them. Contact the company using a phone number or website you already trust.

Do I have a legal claim?

Companies that hold your personal information have a duty to protect it and to tell you promptly if it is exposed. If you worked for, bought from, or were a customer of Harley-Davidson, you may have rights if the company confirms your information was involved. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.