Harley-Davidson, Inc. data breach (2018–2026)

Identity resolution

Canonical name: HARLEY-DAVIDSON, INC.
Normalized: harley davidson— dedupe via name-norm; Microsoft / MSFT collapse to one row
GLEIF LEI: ZDNAWZWXIKMWI51R2A08
SEC EDGAR CIK: 0000793952
Domain: harley-davidson.com

Disclosure history (3)newest first

GLOBALLeak Siteas victim2026-09-10
Harley-Davidson is an American iconic motorcycle manufacturer headquartered in Milwaukee, Wisconsin, USA. Founded in 1903, the company designs, manufactures, and sells heavyweight motorcycles, related parts, accessories, and branded merchandise. It operates globally across the powersports and automotive industry. Its website serves as a digital hub for product information, dealer locators, community engagement, and e-commerce for enthusiasts worldwide.
Massachusetts State AGas victim2018-12-06
Harley-Davidson Motor Company Inc reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-12-06. 10 Massachusetts residents were affected. The report records the breach type as electronic.
New Hampshire State AGas victim2018-12-06
Harley-Davidson Motor Company, Inc. notified the NH AG of a security incident where an unauthorized individual accessed an employee's email account. The breach affected 9 New Hampshire residents, exposing names and Social Security numbers. Harley-Davidson secured the account, hired forensic investigators, and implemented additional email security controls. Affected individuals were offered one year of Experian IdentityWorks.

Subsidiary disclosures (1)filed by group companies

◈ These filings were made by or about subsidiaries of HARLEY-DAVIDSON, INC. — not by HARLEY-DAVIDSON, INC. itself. Corporate relationships are mapped from GLEIF relationship records and SEC Exhibit 21 filings.

Tracked subsidiaries✦ Harley-Davidson Motor Company Holdings, Inc.✦ LIVEWIRE GROUP, INC.

Montana State AGvia Harley-Davidson Motor Company Holdings, Inc.2018-12-06
Harley-Davidson notified Montana residents that an unauthorized individual accessed an employee's email account on September 27, 2018, potentially exposing names and Social Security numbers. The company secured the account, engaged forensic investigators, and offered one year of Experian IdentityWorks services. Additional email security controls were implemented.