mazda

Cybersecurity firm HackerOne is notifying nearly 300 employees that their personal information was exposed in a data breach recently disclosed by third-party benefits administrator Navia Benefit Solutions. Navia revealed last week that it discovered unauthorized access to its systems on January 23, and an investigation found that the attacker had access between December 22, 2025, and January 15, 2026. The company said the hackers accessed and acquired information such as names, dates of birth, Social Security numbers, phone numbers, email addresses, and health plan information. Navia told the Maine Attorney General’s Office that nearly 2.7 million individuals are impacted by the data breach. In a notification submitted this week to the Maine AGO, bug bounty platform and offensive security solutions provider HackerOne said it was recently notified by Navia, which serves as one of its US benefits administrators, that the information of 287 employees may have been affected by the data breach. HackerOne said the notification it received from Navia was dated February 20, but it was only delivered in March. “The safe handling of your personal data is core to who we are as an organization, and HackerOne is treating this as requiring our critical attention,” HackerOne said. “We will undertake our own investigation to assess this incident and are actively communicating with Navia to understand more about how and why this incident occurred and identify immediate areas for improvement to ensure the data of our employees and their dependents is protected.” It added, “HackerOne will also be evaluating Navia’s privacy and security policies and practices. If we are not satisfied, we will explore other potential options for benefits providers with our broker.” Navia said in its notification to impacted individuals that it’s not aware of “any attempted or actual misuse” of the exposed information. However, ‘no evidence of misuse’ is a standard disclaimer frequently issued by breached companies. In Navia’s case there is no indication that cybercriminals have made public any data stolen from the company’s systems, but the aforementioned disclaimer has been used in the past even by firms that had their data publicly leaked. Related: Extortion Group Claims It Hacked AstraZeneca Related: 3.1 Million Impacted by QualDerm Data Breach Related: Mazda Says Employee, Partner Information Stolen in Cyberattack

The notorious Lapsus$ extortion group has boasted on an underground forum about hacking biopharmaceutical giant AstraZeneca and stealing roughly 3GB of data. The hackers say they exfiltrated multiple types of sensitive enterprise data from AstraZeneca, including credentials and tokens, internal code repositories, and employee data. Lapsus$ claims to have exfiltrated Java-based application code such as “controllers, repositories, services, schedulers, configuration files, and Spring Boot resources,” cybersecurity firm SocRadar reports. The leak allegedly includes project paths associated with internal development assets, Angular and Python packages, and AWS, Azure, and Terraform cloud infrastructure information. Furthermore, the hackers claim to have stolen various credentials and other secrets, GitHub Enterprise-related user information, such as roles and account details, and corporate email addresses. “The file tree also points to large numbers of SQL scripts, table definitions, views, sequence files, batch processes, and inventory or order-management components,” SocRadar notes. “In practical terms, that suggests the alleged breach may touch internal business operations, supply chain workflows, and system administration data, not just developer artifacts,” the company points out. Lapsus$ also added AstraZeneca to its Tor-based leak site, offering the allegedly stolen information for sale. However, it has not set a price for it. Should the hacking group’s claims be verified, the blast radius from the incident could be broad, as it may impact employees, partners, intellectual property, and the supply chain. The pharma giant has yet to publicly disclose the incident and confirm the extortion group’s claims. Some voices suggest that the AstraZeneca hack could be linked to the recent supply chain attack that affected Aqua’s Trivy vulnerability scanner, but security researchers are skeptical, saying that evidence is circumstantial. SecurityWeek has emailed AstraZeneca for a statement on the matter and will update this article if the company responds. Related: 3.1 Million Impacted by QualDerm Data Breach Related: Mazda Says Employee, Partner Information Stolen in Cyberattack

Healthcare management services provider QualDerm Partners is notifying more than 3.1 million people that their personal, medical, and health insurance information was stolen in a December 2025 data breach. The incident, the company says, was discovered on December 24 and involved unauthorized access to its network for two days. During this window, the attackers exfiltrated certain information from the “limited number of systems” that they compromised, the company notes in an incident notification (PDF). The stolen information, it says, includes names, addresses, dates of birth, email addresses, medical record numbers, doctor names, treatment and diagnosis information, health insurance information, dates of death, and, in some cases, government-issued ID information. QualDerm also notes that its investigation into the data breach continues, and that it has decided to notify the patients who have been identified to date. In response to the attack, the company immediately activated its response plans, took steps to contain the unauthorized activity, assessed the security of its systems, and notified law enforcement and regulatory agencies. QualDerm told the US Department of Health and Human Services that 3,117,874 people were impacted by the attack. The incident was reported last month, but was added to the HHS’s breach portal this week. The company is providing the impacted individuals with 12 months of free identity theft and credit monitoring services. Headquartered in Brentwood, Tennessee, QualDerm Partners provides healthcare management services to 158 practices in 17 states, covering cosmetics, dermatology, pathology, plastic surgery, and skin cancer care. Related: Mazda Says Employee, Partner Information Stolen in Cyberattack Related: Chip Services Firm Trio-Tech Says Subsidiary Hit by Ransomware Related: Navia Data Breach Impacts 2.7 Million Related: Robotic Surgery Giant Intuitive Discloses Cyberattack

Japanese car maker Mazda Motor Corporation has disclosed a data breach impacting the personal information of hundreds of employees and business partners. The incident, the company says, was discovered in mid-December and involved “unauthorized access to the management system used for warehouse operations involving parts procured from Thailand”. The information belongs to employees of Mazda and its group companies, and to business partners. A total of 692 records were compromised, the company said in an incident notification (PDF). The exposed information, the car maker says, includes company-issued user IDs, names, email addresses, company names, and business partner IDs. Mazda says no customer information was compromised in the attack, as this type of data is not stored in the hacked system, “and therefore there is no possibility that such information was affected”. It also noted that the hackers accessed the management system by exploiting security defects in the application, but did not name the software and did not specify which bugs were exploited. “The cause of this incident was determined to be unauthorized access by a third party through the exploitation of security vulnerabilities in the system used for the company’s business operations,” Mazda said. In November, the car maker confirmed to SecurityWeek that it had been targeted in the Oracle E-Business Suite (EBS) hacking campaign, but said at the time that it had not found evidence of data leakage. Mazda says it reported the newly disclosed data breach to the relevant authorities, promptly applied security patches, revised access policies and access monitoring, and restricted internet access. “Currently, no secondary harm has been confirmed. However, there is a possibility that the exposed personal information could be misused in the future, such as for phishing scams or spam emails. If you receive any suspicious communications, please exercise caution,” the company said. Responding to a SecurityWeek inquiry, a Mazda spokesperson refrained from sharing details on the compromised management system, but suggested that the newly disclosed incident is not related to the Oracle EBS hack. The spokesperson did not attribute the attack to a specific threat actor, citing the ongoing investigation and noting that “no contact from attackers has been confirmed.” Related: Navia Data Breach Impacts 2.7 Million Related: Marquis Data Breach Affects 672,000 Individuals Related: Security Firm Aura Discloses Data Breach Impacting 900,000 Records

Mazda Motor Corporation (Mazda) announced that information belonging to its employees and business partners had been exposed in a security incident detected last December. Mazda is one of Japan’s largest automotive manufacturers, with an annual production of 1.2 million vehicles and revenue of nearly $24 billion. The company said the attackers exploited a vulnerability in a system related to warehouse management for parts procured from Thailand. The system did not contain any customer data. Also, the breach is limited to 692 records. “Mazda Motor Corporation has identified traces of unauthorized external access to a management system used for warehouse operations related to parts procured from Thailand,” reads Mazda’s announcement. “Following this discovery, the Company promptly reported the matter to the Personal Information Protection Commission – an external bureau of the Japanese Cabinet Office – and implemented appropriate security measures and conducted an investigation in cooperation with an external specialist organization.” The investigation revealed that the potentially exposed information includes the following data types: User IDs Full names Email addresses Company names Business partner IDs Although Mazda says it has detected no misuse of that information, the company recommends that impacted individuals remain vigilant because the risk of phishing attacks and scams targeting them is significant. Apart from notifying the authorities, Mazda also implemented additional security measures on its IT systems, including reducing internet exposure, applying security patches, increasing monitoring for suspicious activity, and introducing stricter access policies. At the time of writing, no ransomware group has publicly claimed the attack on the Japanese company. BleepingComputer has contacted Mazda to learn more about the incident, and we will update this post with an official response as soon as it reaches us. Although a data breach was never officially confirmed by Mazda, the Clop ransomware group in November 2025 posted Mazda.com and MazdaUSA.com on its data leaks site, claiming it compromised both the Japanese automaker and its U.S. subsidiary. Update 3/24 - A Mazda spokesperson confirmed to BleepingComputer that the incident isn't related to ransomware, via the below statement: "Based on our investigation to date, we have not confirmed any malware infections or ransomware attacks, nor have we confirmed any direct impact on operations. At this time, no contact from attackers has been confirmed." - Mazda spokesperson Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Mazda has confirmed being targeted in the recent Oracle E-Business Suite (EBS) hacking campaign. However, the carmaker told SecurityWeek that the incident did not impact system operations or production. In addition, the company said “no data leakage has been confirmed”. A Mazda Motor Europe representative clarified that “traces of an attack” were detected, but its “defensive measures were effective, preventing any system impact or data leakage”. The company said it continues to monitor its systems. The carmaker said it promptly applied the EBS patches provided by Oracle in October. Oracle initially said threat actors exploited a known vulnerability patched in July to hack into customers’ EBS instances. The software giant later patched two other potentially involved flaws tracked as CVE-2025-61884 and CVE-2025-618842, suggesting that zero-days may have been exploited in the attacks. However, nearly two months after the EBS campaign came to light, it’s still unclear exactly which vulnerability or vulnerabilities have been exploited. The Cl0p ransomware group, which has taken credit for the campaign, has named both Mazda and Mazda USA on its leak website, but it has yet to make public any data allegedly stolen from the carmaker. The leak site currently states that the company is being given “some time to respond”. However, given Mazda’s assessment of the impact, it’s unlikely that it will pay a ransom. Although organizations are generally listed on the Cl0p website for a genuine reason, the threat actors may exaggerate the breach’s actual scope to increase pressure for a ransom payment. The Cl0p website currently names more than 100 alleged victims of the Oracle EBS campaign, including dozens of major organizations. For some of the victims, the hackers have made public hundreds of gigabytes and even terabytes of files allegedly stolen from their systems. The latest to confirm being impacted is Cox Enterprises, which said the personal information of nearly 9,500 individuals was compromised in the incident. Logitech, The Washington Post, GlobalLogic, Harvard, and Envoy Air have also confirmed being hit. Other major companies named on the Cl0p site do not appear to have publicly addressed the cybercriminals’ claims, including Schneider Electric, Emerson, Michelin, Broadcom, Bechtel, Canon, and Entrust. Related: Sophisticated Malware Deployed in Oracle EBS Zero-Day Attacks Related: CISA Confirms Exploitation of Latest Oracle EBS Vulnerability