Skip to content
Harley-Davidson Data Breach Linked to Cl0p Ransomware Gang

Harley-Davidson Data Breach Linked to Cl0p Ransomware Gang

First seen 12 Sep 2026, 16:40 UTC

Article Content

Browse articles
ThreatCluster AI
ThreatCluster September 12, 2026 at 18:55 UTC
  • Cl0p claims to have stolen 270GB of data from Harley-Davidson.
  • The breach is part of a broader campaign targeting companies using PTC Windchill software.
  • Harley-Davidson has not confirmed the breach details but is aware of the claims.

The Cl0p ransomware group has claimed responsibility for a data breach involving Harley-Davidson, alleging the theft of 270GB of internal data. The breach was reported on September 10, 2026, when Cl0p added Harley-Davidson to its leak site, indicating that the company did not engage with them. Harley-Davidson has acknowledged the claims but has not provided further details on the incident. The leaked data may include sensitive information related to PTC Windchill software, which is widely used in manufacturing. Other companies, including GE and ALDO, were also reportedly targeted, with an additional 400GB of data published by Cl0p. The specific impact and details of the leaked files remain unclear as the investigation is ongoing.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-06-18
CVE-2026-12569 published
A vulnerability was published that could be relevant to the attack vector used by Cl0p.
N/A
2026-06-25
CVE-2026-12569 added to CISA KEV
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog due to active exploitation.
N/A
2026-09-10
Cl0p claims breach of Harley-Davidson
Cl0p added Harley-Davidson to its leak site, alleging a 270GB data theft.
Cybersecuritynews
2026-09-11
Cybernews reports on Cl0p's claims
Cybernews confirmed the breach claims and noted the potential links to PTC Windchill software.
Cybernews

More articles in this cluster (4)

Following this threat?

Track Cl0p, ALDO and CVE-2026-12569 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed