Loading story…
Kubota North America disclosed that an unidentified threat actor gained unauthorized access to parts of its internal network from March 16 to April 20, 2026, later determining that human resources and employee-related files had been accessed. The company said the exposed information included names, Social Security numbers, dates of birth, taxpayer identification numbers, driver’s license or other government ID details, direct-deposit bank account information, corporate payment card data, and some benefits enrollment and limited claims information affecting employees and their dependents.
Kubota said it secured affected systems, engaged external cybersecurity experts, notified law enforcement, and began sending individualized notices to affected people on June 30 while offering complimentary identity protection and credit monitoring through Kroll. Reporting on the incident differed on operational impact, with one account saying routine operations in the North American division were disrupted while another said no operational disruption was reported; no threat actor had publicly claimed responsibility at the time of disclosure.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
Following discovery of the SLA incident, IBM revoked access to the affected cloud environment. SLA began notifying impacted individuals and investigating with IBM, Singapore government agencies, external cybersecurity experts, law enforcement, and the Personal Data Protection Commission.
The Singapore Land Authority disclosed a cybersecurity breach involving unauthorized access to an IBM-managed cloud environment used for development and testing. SLA said the affected environment was separate from live operational systems and that core land systems and records were not impacted.
Kubota began sending individualized email notifications to affected people on June 30, 2026. The company also offered Kroll identity protection services to those impacted.
On April 30, 2026, Kubota determined that human resources files had been accessed during the intrusion. The exposed information included sensitive personal and financial data such as Social Security numbers, dates of birth, taxpayer IDs, driver's license details, direct deposit information, and corporate card data.
Kubota said the unauthorized access to its network systems continued until April 20, 2026. The company later secured affected systems and investigated the incident with external cybersecurity experts.
Kubota North America said an unidentified threat actor gained unauthorized access to some of its internal network systems beginning on March 16, 2026. The intrusion ultimately affected files containing employee and dependent personal information.
The Singapore Land Authority said a dataset created in 1998 for development and testing, which was intended to contain mock and anonymized data, instead contained real names, NRIC numbers, and former property addresses. Preliminary findings said about 70,000 individuals were affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourceteiss.co.uk
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kubota North America Corporation disclosed that an unidentified threat actor had access to parts of its network from **March 16 to April 20** and accessed files containing sensitive personal information tied to employees and their dependents. The company said it determined on **June 16** that one or more human-resources files may have been viewed during the intrusion, with exposed data potentially including names, Social Security numbers, dates of birth, taxpayer identification numbers, driver's license or other government ID numbers, direct-deposit bank account information, corporate payment card details, benefits enrollment data, and limited claims information. Kubota began sending individualized breach notifications on **June 30** and is offering affected people **Kroll identity protection services**. The company said it has implemented additional security measures following the incident and reported **no known operational or business disruption**. As of publication, no ransomware or data-extortion group had publicly claimed responsibility for the breach.
Jul 2, 2026
Mazda Motor Corporation disclosed that attackers gained unauthorized external access to an internal warehouse management system used for parts procured from Thailand, exposing **692 records** tied to employees, group company staff, and business partners. The company said the intrusion was detected in mid-December 2025 and traced to exploitation of an unpatched vulnerability in the affected system. Exposed information may have included user IDs, full names, email addresses, company names, and business partner IDs, while Mazda said **no customer personal data** was stored in the compromised environment. Mazda reported the incident to Japan’s Personal Information Protection Commission, investigated the breach with external cybersecurity specialists, and publicly disclosed the matter after completing its review. The automaker said it has patched the system, revised architecture, reduced internet exposure, restricted source IP access, strengthened monitoring, and tightened access controls, with plans to apply similar protections elsewhere. Although Mazda said it has not confirmed misuse of the data or other secondary damage, it warned affected individuals about elevated risks including **phishing**, **business email compromise**, and targeted spam.
Jun 29, 2026
OnTrac, a U.S. parcel delivery company, notified customers that attackers breached its corporate network and accessed certain files containing personal information. The company said the unauthorized access occurred between March 20 and March 22 and was detected on March 23, prompting an internal investigation and the engagement of a third-party incident response specialist. The exposed information included customer names, though the full scope of compromised data was not publicly detailed because notification materials were redacted. OnTrac said it re-secured the affected data, verified it had not been distributed, and had not identified fraud or public leaks linked to the incident; the company is offering affected individuals 12 months of credit monitoring and identity protection through **CyberScout**.
Jul 28, 2026